To add to that, Linux is easier to secure because is found mostly in the datacenter (I'll ignore Android for this one). It's not only more robust but it's secured according to a whole different standard than desktops since it doesn't need to be operated by Average Joe.
On the other hand the vast majority of Windows installations are either regular home users (with no knowledge for properly setting up their computer, and ideally with the updates disabled because they read on the internet that updates are bad) or corporate desktops (which might be secured better but still at the mercy of a user clicking on everything).
Linux and BSD are found in a lot of places, it is more to do with its design being supportive of all kinds of deployments rather than only just popularity i think.
Windows Server administrators are lot more likely to be "certified" and "trained" by MS approved courses than linux admins and of course it does not help.
I would say its more likely to find an average joe ( from a devops perspective) running a linux box than a windows box.
That's a whole different kind of average joe. A mediocre tech person is still an order of magnitude more qualified to take care of a machine than a mediocre user.
On the other hand the vast majority of Windows installations are either regular home users (with no knowledge for properly setting up their computer, and ideally with the updates disabled because they read on the internet that updates are bad) or corporate desktops (which might be secured better but still at the mercy of a user clicking on everything).