Speaking as someone doing security research on WebGL but no real dog in this fight (aside from developing on WebGL on the side, making me potentially biased in

Speaking as someone doing security research on WebGL but no real dog in this fight (aside from developing on WebGL on the side, making me potentially biased in its favor), nothing MS has said is Windows-specific or remotely exaggerated. In fact, they explicitly didn't talk about many potential attack vectors against WebGL, which makes me think they really don't care much about this either way.