Depending on how you report them, statistics can be made to say anything. All it takes is some careful omission of facts that don't support your conclusions, generally.
I have no way to verify average patch times for Linux and Windows in a truly objective and absolute fashion. I have seen a report that Windows patch times average less than Linux patch times, though. This report was prepared by a vendor of Windows-based security software, which raises the specter of a conflict of interest, of course. The statistical data also included only things covered by Windows Update for the Windows side of the equation, though, and included patch times for thousands of applications, many not included in default installs of most major distributions. In fact, many of the applications counted toward Linux patch times have Windows versions of the same software packages available. As such, it was largely an apples to oranges comparison, and easily discarded.
My personal experience leads me to believe that patch times are much, much shorter for Linux than for Windows, particularly for core components and critical vulnerabilities. The fastest-ever patch time for a Windows security flaw, for instance, was reported to be the recent WMF vulnerability, at less than ten days. The average for the Linux kernel is, as I recall, less than a week. While this doesn't include all of the core Linux operating system components, it certainly provides a very wide range of vulnerability patch response times to pick and choose the fastest turn-around in the case of the Windows patch, and it doesn't fare as well as one might have hoped. I have seen Linux security patches appear in a matter of a few hours, in some cases as few as two of them, by contrast to the Windows fastest of ten days.
I'm further skeptical of reports of Windows patch times, considering the clearly documented cases of Windows vulnerabilities taking eighteen months or more to fix, and in some cases being declared unworthy of patching entirely. I think it likely that anything that Microsoft has decided it will never patch isn't included in these statistics, because it's difficult to include "never" in an average of patch times.
Furthermore, one must wonder what is meant by "known security flaw". Since Microsoft has managed to strongarm security firms into refraining from reporting flaws to anyone but Microsoft until after a patch is released, that could simply mean that a flaw known to Microsoft that takes them eighteen months to patch will be reported as a zero-time patch because it was not known publicly. Meanwhile, Linux vulnerabilities, in the open source development communities, tend to get publicly reported immediately, and still end up patched before anyone gets around to exploiting them.
I'm highly skeptical of claims that Linux servers get successfully exploited more than Windows servers, and would require some documentation before giving them any credence. I've never seen any such reports, though I have seen some that indicate they are in fact attacked more often, regardless of success rate. Even if they are "successfully" exploited more often in terms of absolute numbers, however, it's possible that this is merely a statistical artifact of the greater number of Linux servers in certain implementations than Windows servers, where a lower percentage of successful attacks might involve such a huge number of servers that the absolute number of successful attacks might be higher. Even then, however, I'd be skeptical without some solid evidence, based simply on my knowledge of OS architecture and security practices. Another possible interpretation might involve measuring only certain types of security compromises.
