Earlier quoted context omitted.
And yet, when you looked at e.g. the web server data back in the early 2000's, you had 70% apache 25% IIS -- and yet about 20 times as many exploits (and much more effective at that) for IIS. The reason was, to put it bluntly, that IIS was designed without any regard to real security, whereas Apache had _some_ regard to security. That's also the case for Windows through its history; it has been making leaps recently,…
I would like to hear the specific ways in which you think that Apache was designed for security in ways that IIS wasn't, and how those things persist into modern IIS.
There had been security audits of the apache code base since its early dates (as NCSA Web Server), whereas IIS didn't (or, judging from its track record, if it did have they were done by incompetents who didn't notice the strcpy(host_field, ...) would overflow with a host name > 1024 bytes.
IIS had everything in the same process, meaning every thing exploitable somewhere would bring the whole server with it. Apache used a worse-performing but better compartmentalized process-per-request model.
Just to be clear, apache at the time was NOT a beacon of security or good design or anything. But it did follow standard Unix practices, which put it a significantly better place than the IIS of the time (which was written like a Windows desktop program). At the time, IIS exploits were being found at a rate of 4 remote roots per month, with worms actively exploiting them, whereas apache had one of these every several months, usually only exploitable if you knew the exact O/S version it was running on.