Vendors put out dozens of security patches each year. Sun Microsystems published eleven and Hewlett-Packard 16. The point behind looking at these numbers is not to judge a vendor or its product as good or bad based on the number of security advisories in a given period. It is much better that the vendors publish advisories instead of pretending not to have security vulnerabilities in their software. All software has bugs, and a more realistic correlation is between the lines of code a vendor supports and the number of bugs discovered.
Popularity does come into play.
Earlier versions of Microsoft's Windows NT rarely had security problems reported. But that was back before NT was widely used, or well enough understood by the hacker community. That is no longer true today. The real trouble is inertia. Or suppose you have 1200 workstations, all with slightly different hardware configurations, sitting on desktops throughout your organization.