This is wrong for a different reason than about Linux. The Debian vulnerabilities include all software distributed by Debian -- that is, as of current count, 1

This is wrong for a different reason than about Linux. The Debian vulnerabilities include all software distributed by Debian -- that is, as of current count, 149.009 different packages. It then compares this number to the vulnerabilities distributed by Windows... just the operating system. For that matter, it separately breaks out Firefox -- which receives published vulnerabilities in Debian itself! All told, this article is questionable, at best.