Linux is currently having parts of the kernel rewritten in memory safe languages like Rust, eliminating entire classes of exploits. Wayland is being developed with a far more secure architecture than the old X.org window manager. One important reason why they can do this is because the whole industry follows and stuff like drivers can be updated at the same time to keep everything working, and it doesn't even need to be the original developer patching it.

Microsoft's opacity makes it near impossible for them to do the same thing, so much of their security improvements are essentially hacked in on top of old code to not break compatibility. Instead of eliminating bug classes they rely on tons of techniques to make them harder to exploit instead - yet not impossible.