It is expected that the smallest attack surface will have less critical vulnerabilities, comparing an entire distro gives you a different picture, since categor

It is expected that the smallest attack surface will have less critical vulnerabilities, comparing an entire distro gives you a different picture, since categories like code execution get similar results. The stark contrast is in the privilege escalation vulnerabilities from the Windows side vs the other categories on the Linux side. I would assume that many persons prefer a server to go down, corrupt its data and leak it, rather than get compromised. The fine print is that the leaked data may contain information to compromise the server[1]. [1] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed