A truely secure system is one that had to be designed in from the beginning. SMTP (the email protocol) was not designed with security (or authentication really) in mind and while it has had some measures bolted on, it's still way to easy for exploit (spam wise).

You also have to remember the Microsoft culture. Microcomputers (or home computers) were intially used by a single person nearly exclusively, so things like administrative rights, user profiles, etc. were never a real concern of Microsoft (why should I have to log into my own computer?). You would think that the networking explosion of the mid/late 80s would have fixed some of the problems, but Microsoft never addressed those issues (Novel I think did, but Novel is not Microsoft).

Unix, at least, has 30 years of multiple users per computer, which means administrative rights, user profiles, etc. so it's a bit more mature than what you find on Windows, so the concept of things like security is more baked in to the core of Unix and Unix applications than those from DOSland.

You also have issues of programming languages. Most of Microsoft Windows (and Unix) is implemented in C, which is, as computer languages go, pretty low level and it requires you to manually manage some aspects of program design that are too easy to mess up. Most security problems fall down to buffer overruns, which happen when a programmer only expects X number of characters to fill a buffer, and assumes that the program will never receive more than X number of characters but more data is actually given, overwriting important data and/or code of a program. Some of these are easy to find, others nearly impossibly so.

And another reason why Micorosft is taking it on the chin (more or less) is that on the desktop, we have a monoculture with Windows making up over 90% of all desktop computers in use, which makes for a very large target indeed. The Internet Worm of 1988, only targetted two types of computers, Sun workstations, and VAXes, two of the most popular machines on the Internet at the time, and it was only able to infect about 10% of all hosts on the Internet (and it was felt, mostly because of the low speed of everything back then). And because of the relatively low number of infections, the worm is no longer active (in fact, it was erradicated in a few days)---I'm still receiving hits from machines infected with Code Red and Nimda, which first hit in what? 2000? 2001?