Malware writers are increasingly financially motivated, and they will always look at the softest targets There's a joke going round that contrary to popular belief, the most powerful supercomputer in the world in fact runs Windows: it's the Storm botnet
WP, and there's some truth to it. Windows is the most cost-effective platform for a spammer to hijack. There are several reasons for this:
(a) There are lots of windows machines
(b) Many of them are in the hands of naive users: most Linux systems out there are run either by enthusiasts, or servers with a real sysadmin. It's more difficult to hijack a system kept up to date.
(c) As I mentioned earlier, Windows has serious, and I believe fatal, architectural flaws harking back to the pre-internet days of Windows 95 and OS/2 Warp. GNU/Linux is based on Unix, which was designed for mainframes with time-sharing in mind, not a single-user OS for an unconnected microcomputer, which made proper user permission and privilege control designed from the start, not hastily slapped on top of an ageing kernel.
(d) As Whitfield Diffie
WP said, the secret to proper security is less reliance on secrets. Microsoft practice Security by obscurity, and they can't change that without throwing their whole business model through the window. Free software isn't a silver bullet, but you can guarantee that the most popular packages have been scrutinised much more than MS's. The infamous SQL Slammer
WP Worm targeted MS SQL server, not the far more popular MySQL, because security-wise, it's weaker. And it'll always be weaker, because free software is better.
If you want security, there's no better system than OpenBSD. It's not perfect ("Only two remote holes in the default install, in more than 10 years!", as they say), but it's damn close. And that's because there's no software written more securely, and more audited than OpenBSD.
Again, it's not that MS programmers are incompetent, it's that they have a different demographics, a different history, and quite frankly, different priorities. And that's why it is, and will remain, the security hole that it is.