Security isn't necessarily better or worse, but different. Remember that Windows (used to?) run code on
every attached USB Mass Storage. The bundled web browser executed native code embeded on web pages (but don't worry as it's all signed, right?) and great efforts were made to build enterprise software on top of it. That has nothing to do with unix-ness or lack thereof. It's also nothing you can fix by layering more technology over it.
Both systems have unpatched root exploits if you have access to the display subsystem. Both were initially developed for trusted local environments, then adapted for public network use some ten or fifteen years later and whatever security issues that brought was patched as they were found. I'm just not sure how to argue more or less security in that environment. Users still get owned by running Flash (so no ASLR for you) and Outlook.