If we're talking services, it's similar. 100 companies, 50 using MS, 50 using random non-MS software. 10 breakins in each category. MS gets the finger pointed at them 10 times. 50 random non-MS companies each get the finger pointed at them just 1 out of 5. But both MS and Non-MS have the same amount of issues in this hypothetical example, but one looks worse, even if they're not.
In fact there could be 5 breakins with MS and 15 with non. But MS would have a finger pointed at them 5 times and 15 of the 50 random companies would each have a finger pointed at them only once. Yet, if you added up the numbers you'd be safer with MS (5 failures out of 50) instead of random non-MS (15 failures out of 50).
I'm not saying that's how it is. I'm saying it's plausible.