Both have had their share of vulnerabilities and continue to do so. I think it's the admins. Linux admins are more inclined to do it because they want to. Windows because they have to. I try to stay out of user facing environments so my experience is out of a very tiny portal.