Did anyone bother to read the guys blog that this article is sourced from?
I'll quote the relevant section:
We will also see some bugs that are unique to Windows Vista. But I believe this number will be reasonably small.
There is one thing you will see that I'm not too thrilled about, but it is what it is. The MSRC rarely reduces the severity of a buffer-related security bug because a defense with no security guarantees such as /GS or /SafeSEH is in place. UAC will be a speed bump, but I doubt we would reduce the severity of many bulletins if UAC is the sole mitigation. The MSRC folks are, understandably, very conservative and would rather err on the side of people deploying updates rather than trying to downgrade bug severity. So don't be surprised if you see a bug that's, say, Important on Windows XP and Important on Windows Vista, even if Windows Vista has a few more defenses and mitigations in place. As I understand it, the MSRC will call out defenses that come into play.
He's splitting hairs over SECURITY UPDATE CLASSIFICATIONS that arn't(at time of patching) exploitable on vista but are on xp, being rated with the same level of severity. Imho, thats pretty fair. Look at the BSD guys recently, it wasn't a escalated from a bug to a vunerability until it was proven it was exploitable.
This bothers him because it is going to make vista look bad when it comes time to compare vistas first couple of years to xp's first couple of years, if all you go on is the patches vunerability ratings...
Ok, so theres a buffer overrun in MS_arbitary.exe that causes a crash in vista, but can result