This XKCD point is not wrong, but it's also a kind of whataboutism: Windows as used by most users is not very good at protecting user data since unsandboxed applications are typically all run as the same user with free access to all the account's files.

Most platforms are edging towards sandboxing applications, with OS X app store, UWP, and the various Linux snap/flatpak/appimage etc things. Web apps and iOS/Android have their own tings.