Actually you just backed him up....
The popularity argument is based on the number of installations, not how strong or weak and individual system is, which could be based on teh number of accesses if
you don't want to put the effort in to securing each avalaible access.
Which MS et al, definitely don't, as they have no sensible commercial reason to do so.