That's for vulnerabilities found in 2016 though, right? It would make sense that more are found in W10 (which was 5-17mos in 2016) than W8 (which was 40-52mos

That's for vulnerabilities found in 2016 though, right? It would make sense that more are found in W10 (which was 5-17mos in 2016) than W8 (which was 40-52mos in 2016), because of their relative time on the market. To answer the question, we'd have to look at W10 at this point in its life-cycle compared to W8 at a similar point (and control for things like more active vuln researchers).