People get infected through exploited, unpatched vulnerabilities.
That's not true, of course. Not all vulnerabilities, even if exploited, can be used to infect the target machine.
The word "vulnerability" is way too general to draw any conclusion from it... and that's why the "number of vulnerabilities" means nothing for the "security" (also somehow general term).
If Windows had 200 vulnerabilities, allowing remote code execution by simply sending a handcrafted network packet there, and Linux had 201 vulnerabilities, allowing DoS attack on the machine if you already had an account there - which one would you call more secure?
[Disclaimer: I'm not saying that it's this case, neither I'm saying that Linux is more secure than Windows or vice versa - I'm just trying to get the point through.]
To learn anything relevant about security, you'd have to weight each vulnerability by its seriousness (which is something hard to evaluate objectively), you'd have to consider how easy it is exploitable, how many machines it affects, for how long it remained unpatched... and finally, you should also count all the
unknown vulnerabilities which might be exploited in the future. So, all in all, you're up for a mission impossible.
