... and they're still finding holes in Unix, Linux, Mac OS, BSD, Windows CE/Mobile, Symbian...
One hole is all you need.
Security is about being proactive and reactive, not about being perfect. No system is invunerable.
I'm curious as to why they're not recognizing the .NET platform however. Is it due to the platform itself (the base class libraries to be specific), the languages (this would make very little sense, if any at all), or Windows? I'm inclined to think the latter.