This is such a loaded question. There are flaws in all software, and flaws are relative because you're not taking into account severity.
For example, let's pretend I have an OS that has absolutely no remote access flaws. It is verified to have no bugs you can get to over the network. Unfortunately, if you hit the F6 and shift and numlock key at the same time at the console you can log in as root. That's a pretty significant bug. But over a network, it's absolutely rock-solid safe from hackers.
And what about the opposite? Where anyone can connect via a connection to port 37, for example, to a terminal session?
Then there's third party apps. Linux gets dinged by other vendors comparing vulnerabilities because companies like Microsoft count an APACHE vulnerability that gives access to privileged directories as a red mark against, say, Ubuntu or Red Hat. It's not something in the kernel, it's not their problem, it's the Apache foundation's. But it counts against them.
There's people who assume that the more people use it, the more of a target it is. That's still flawed, because it only serves your purpose if you are targeting those platforms for your purposes. For example, if you know how to remotely open a Chevy's car door with a hacked keyfob, would you sneak into a Ford dealership? Duh.
So if you're targeting servers, do you care about the number of people using Windows XP at home?
Or why are you hacking it in the first place? There was a time when hackers did things for reputation. Apple likes tooting the horn that they're far more secure than Windows. Well...what do you think gains more credibility points with fellow miscreants?
And no, the more that people use the software, it's not the case that they'll necessarily find more bugs. They find bugs in their workflow. That's it. Not many home users are hammering away at the IP stack finding flaws with buffer overflows. Two researchers hammering on OS X's IP stack are going to find far more bugs and flaws than thirty thousand home users sitting on their duffs playing World Of Warcraft. And neither of them are open source so they don't have full access to the source code anyway.
Then there's the tipping point. How many computers does it take to be a major pain in the butt on the Internet? Do some math and you'll see that crippling a major website isn't a task that requires half the planet's home PC's. There's MORE than enough Macs to do it. So whether your bot army is 500,000 strong or 50,000 strong, either one would make a nice platform from which to wreak havoc.
They're all vulnerable. The MOST vulnerable part is the people. If I can get you to install a program on your PC then you're a target. And it's your fault for installing that naked women of summer screensaver I told you was so nice but didn't tell you was also installing a keystroke logger when you gave the installer permission to write to the system directories. There was a study that showed most people would give up their computer passwords for a @#!%! chocolate bar!! C'mon! What good are your security measures if your users will spill their guts for a Hershey's bar? I have users that share passwords all the time. If you start a porn site and watch where users come in from, chances are the passwords users are using on your site will match or be of the same theme as what their company servers or company accounts are using. If they're all numbers you're probably going to end up with birthday information or social security number information, meaning maybe even access to bank records via ATM. Your VPN encryption and lack of bugs in your web server and careful sanitizing of database access on your fancy website isn't going to protect against dumb users with a password of "GOD".