One question that is worth asking is how many of these exploits can be done remotely, and how many of these exploits require physical permission to a system?

It is worth noting that there is a difference between exploits that require physical access and those that can be conducted remotely.

Speaking just for myself, I am not certain which operating system is more or less secure, but I do not think that operating system security matters as much as user habits. I have ran Windows XP since 2001 and I have never once suffered from malware or a virus (except when I transferred a USB-stick virus onto one of my computers just to see what would happen). I know that the plural of anecdote is not data, but it is worth noting that it can and has been done.

Many of them can be done remotely, as has been done at Pwn20wn for several years on OSX.

But to actually create a weaponized attack that can get on a lot of machines requires a fair bit of work. If you're going to do that, it's probably worth going the extra mile and attacking a much larger installed user base.

But, what's even easier is just doing malware that the user installs. You can write it in a fraction of the time, and you probably get similar infection rates.