Things like OLE can be said in retrospect wasn't a good idea security wise. Autorun kept delivering for more than a decade. Perhaps GDI could do with a security model. That sort of things makes it unnecessarily difficult to secure the system.
The reason we don't hear about Windows router botnets is because nobody bothers building those boxes in the first place. You put your Windows box behind a small Linux box in order to connect it to the Internet, not the other way around.
Processors themselves are insecure. There is no hope this war can be won.
In the past, security focused on multiple users of the same machine. Users should be safeguarded from each other. Applications are installed system wide by a knowledgeable sysadmin and can be trusted.
But this threat model was completely dated. Today, most machines have 1 user. But the applications are either cheaply written with no respect for other applications, or are actively harming the user by stealing his data, and the average user is his own sysadmin but really doesn't want to do the job or knows how. Additionally, DRM means the machine tries to defend itself from its owner, preferring multinationals instead.
The windows XP and standard unix security model defend against the old threat model. Android, iPhone and Vista + defend against the new model.