From the surface down to any product, what does not have a hole.

That's hardly Microsoft-specific though. There was even a piece on HN a few days ago noting that no Microsoft products featured in the current top ten list of serious software vulnerabilities, partly because iOS and Android had moved in.

(And if someone with a better memory than me could elaborate on whose list this was, or even post a link, that would be grand.)

You are referring to a rather linkbait-y PR piece from Kaspersky. I'd rather not link to it since the intent behind it was pretty obviously co-branded promotion of KAS and msft rather than independent journalism conducive of critical thinking.