Microsoft issued over 100 security bulletins in 2000. It's not just the quantity, but the seriousness of the flaws, a number of them allowing complete control of the network to anyone exploiting them. Microsoft points out that Linux has a similarly high count. Funny thing about how the counts are kept - if a Linux flaw is found, and Red Hat, Caldera, SuSI, Mandrake, Turbo Linux and Debian each issue a notice on it, the count is 6. On the Internet, that's just not true, but it's what business wants to hear, so it sells the product.
Staff often has neither the skills nor the budget to keep up with patches.
Microsoft defends itself with demonstrations showing how secure its products are, but they do not use anything approaching real world conditions. They boast that Windows NT 4.0 achieved government C2 security certification. This is true - for a single server configuration, in a locked room, with no floppy drive, no network card , no modem, and no serial connections, in fact no connection but a power cable. Not a particularly useful server in my opinion. C2, by the way, is pretty much the bottom layer of the security stack.