Any networked operating system is going to have security holes that need to be patched.

Agreed. No piece of code above a few thousand lines will ever be flawless.

Windows was a big fat target with more hackers pounding at it. So it had a lot of published exploits. Microsoft has started to get their act together and is getting better about security holes. So it makes sense that Linux is getting more targeted now.

Agreed as well. Many people have the perception that market share is the main driving force, and that is a factor. However, exploitability is a bigger factor as MS has quite a few more problems on the Web Server front then Unix with security. MS has never had a majority market share on the web server front.

When you're asking the question "how secure is it?", the argument between open-source and proprietary security models is pointless.

No it's not. With closed source software, you have to wait for the company that made the code to patch it. If they went under, and took their code to the grave, you then either have to live with the problem, or move to new software. Open source software can, and routinely is fixed by others. Plus Open source software is usually patched quicker, as there is no initial need to compile the program to get the fix out. Open source does have the problem that people can just look at the code to find vulnerabilities, but in general there are more people doing this and fixing the code then there are people releasing vulnerabilities.

... Does the OS come installed with a bunch of unsecure defaults? ...

The answer to most of these is that generally MS software is still in the mindset of enable everything at install, disable it later. Patches for problems take longer to obtain on the MS front, and some patches sneak in legal rights changes (IE the Media player security patch that prevented MP3s from running scripts added a note to the EULA granting MS the permission to delete your media at any time if it was deemed in violation of DRM crap). In general, the statement of "Microsoft's future is Unix's past". Most linux distros that I have installed in the past two years default to the proper method of disabling everything, and letting the admin enable what is needed later. Other Unix variants have been doing that even longer. MS is now only thinking that this is a good idea with .Net server.