By default, neither operating system is running any publicly accessible services. By that metric, they're equally "secure" by virtue of not having anything an a

By default, neither operating system is running any publicly accessible services. By that metric, they're equally "secure" by virtue of not having anything an attacker could attack on first startup. After that, you could look at browser exploits as the most common attack vector. They tend to go back and forth, but all of them get pretty quickly rooted in competitions like Pwn2Own.