To Friendly neighborhood Linux Guy,
I applaud you for an attempt at breaking down the differences and coming to the rescue of Microsoft (who has indeed gotten better with Server 2008 and WIn7). However you sound quite informed unless the person reading it knows about what your talking about. I have run into this type of verbiage often in my career which usually ends up mis-educating some would be entrepreneur into thinking they are more aware than their IT team. Frankly you have mis-represented quite a few points and they need to be cleared up before totally contaminating the understanding of the untrained.
a: In the linux world, services do not always run as root, most do not run in the same group as root. Only custom apps will have the user root utilized when the developer needs to get something to work, then figure out what happened to permissions. Some times the dev will fail to complete that part of the project, opting to show a quick running version. Security in Linux is very good though not foolproof, there are 9 steps to make an application run automatically on a server, (Download, compile/execute, Meet dependancies, Find dependent Libraries, ModKernel, Load modified Kernel, Cron/init, and finally maintain the open port). Each stage requires more than a simple entrance via exploitable web code, which can compromise the web server easily resulting in off running services such as PHP Mail agents for spam lists or partial TCP requests nestled in a complete TCP packet for DOS/Overflow attempts.
b: The concept of Windows running services in protected separate running Kernels is great. However even Vista still runs a serial application stack which means non related applications can bring each other down. Services are all based on a single run process engine. While the engine can instantiate itself, this is the result of the system loosing access to the original running engine. Now with MS Windows there is protected memory space, which is designed to render data non readable in an overflow/dump attack. Linux has that to, it is called a best practice policy for operating systems.
To summarize, please do some research on current technologies and advertising dogma before you use them in policy, project, or posting a response. Companies usually have two options when fixing problems with their products. 1. Fix them, (remember it is technology nothing is perfect). 2. Produce deceptively similar terminology to downgrade the alarm of the issue to the point of non existence. Unfortunately in the long run, option 1 is the cheapest and best practice, while option 2 is the most used.