How many vulnerabilities is there in Ubuntu 6? Debian Sid? Windows XP is FIFTEEN YEARS OLD and was designed to run on a Pentium II 400MHz with 128MB of RAM. If they are too damned cheap to upgrade or replace a PC that is a decade plus old why should that be MSFT's problem? Apple doesn't support the G3s and G4s either but you don't see anybody trying to claim that as any "proof" of anything.
As for your other point its nothing but moving the goalposts and therefor meaningless, because we both know if the numbers were reversed the FOSSies wouldn't be arguing about what "level" the vulnerability is, which just FYI means exactly jack and shit as we have seen with tricks like the "WTF" virus you can use a low level vulnerability (in that case unprivileged user ID spoofing allowing the attacker to send a message) to then effect a higher level attack (user thinks message is legit, clicks on link provided which takes user to a page filled with zero day attacks) so the idea of "levels" really doesn't mean shit anymore.