It's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)". Sure, that happens in open source

It's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)". Sure, that happens in open source projects too (openssl anyone?), but it seems like an exception rather than a rule. If there are so many of these multiple-version vulnerabilities in Windows that the author of the list had to specifically break Windows into individual versions, then that speaks for itself.