It's not how well written the code is that's at issue - like Phil(ip) says, you can't write code ont he scale of an OS without introducing errors, especially if you're human
The issue is how quickly those errors are discovered, who discovers them, and how quickly they are patched. We've no idea what errors exist in Microsoft products because we cannot see the code, and we're at their mercy to provide patches, which in the past have had errors in them... In the example Paul posted the person discovering the error, fixed the error. That doesn't happen with Microsoft - it's much more likely that the person will develop a virus or other malware to exploit the error
You'll notice that Microsoft responds more quickly to an error that has a known exploit than to one that doesn't - even it's rating system supports the idea that an error without exploit isn't important.
I'm pro- open source. I understand the concerns of business and the support issues, but it just seems an altogether better way of producing software.