Microsoft itself says that if you're really serious about security, you run the headless version of their servers, as 70% of security bugs are in the GUI.

Now, a desktop system is always going to run a GUI, but a server has its attack surface reduced by not having a GUI, and most Windows servers have a GUI.