I think it is more about market share than anything. Viruses targeting the end user are, I think, fairly uncommon. But I don’t think remote and local exploits are particularly rare since Linux has massive server market share. I don’t have stats handy so maybe I’m full of it, idk.

I don’t think Windows has much in the way of default exploitable services anymore. Neither does Linux. I mean back around 2000 it was kind of a nightmare on both platforms. But default configs have gotten pretty good in 20+ years.

I’m not aware of a whole lot preventing various local privilege escalation attacks on Linux but maybe there have been developments in the last several years that I’m not aware of?

I know Windows 10 implements some additional memory protections for the LSA subsystem process to address Pass-The-Hash attacks.

Linux still has setuid/setgid executables as one vector. But I would imagine various forms of kernel exploits are more or less similar to both.