Windows is closed-source and edited by an American company, so I think there are security implications beyond the number of vulnerabilities that have historically been found.

You are comparing Windows 10 (just desktop OS) with Ubuntu for all versions, with all packages, including the server ones.

Windows Server, each version, has its own product for CVEs, as does Internet Explorer.

My point was more that you can't treat Windows as "just a bootloader" as the parent to my post was implying. You also need to worry about security. I'm sure that a stock Windows install has more remote security vulnerabilities than lilo or grub.

No matter how much you lock down the guest VM, the host OS is still a weak point.

You need to get Pro version of Windows 10 to get full disk encryption...