However, the biggest point of failure is from the average systems administrator and this is the case with both OS's. Sure critical security patches may be available and ready to install but the simple fact of the matter is the average person (or even average sys admin at times) has the IQ of a small fish in terms of security conscious.
True enough Thetan, this is why most of them have their jobs just because they went to a community college to get their CompTIA+ and Linux+. That's the way it is around here, anyways. I'm not anyone to talk, mind you, but I know these credentials aren't necessarily going to get you a reliable sysadmin.
Digression Di*gres"sion, n. [L. digressio: cf. F. digression.]
1. The act of digressing or deviating, esp. from the main
subject of a discourse; hence, a part of a discourse
deviating from its main design or subject.