While the market share explanation is definitely true, it is not the WHOLE truth... Not even the most important. Because of the inherently monolithic nature of Windows (single vendor, closed source, current version), the Windows operating system is much more vulnerable than any open source operating system will ever be. Every user of Windows XP SP3 is running the exact same, binary (bit-for-bit) copy of notepad.exe. This means if you find ONE exploit in the notepad.exe program, you can exploit EVERY Windows user, immediately, just by replacing a specific address in the executable. On the GNU/Linux platform, everything is more modular. While the "current version" of Linux is 2.6.28.7, there are probably no more than a few hundred users running a 2.6.28.7-vanilla kernel, and even so, almost none of those will exhibit binary equivalence because of different modules, drivers and compiler options, as well as different compilers doing the compilation on different hardware. And that's just the kernel! Now consider the fact that there is virtually an infinite number of combinations of operating system tools, daemons and utilities, and versions, even on one specific distribution. If you find a way to exploit one specific ELF, there is no guarantee that exact exploit is even possible on just one more system than tested.
In no way am I saying Open Source is inherently more secure. I am just saying that it makes it a heck of a lot less likely to encounter two binary equivalent systems in the wild.