Heres what i think.
The think open source software is that its based on work people do in their free time. Its not based on people getting paid to make quality work. With that being said thats why code that comes from a business like says ms should be more resistant to such bugs. The truth is though that since ms is the king of the hill in market share all the spyware and virus makers target them in an attempt to get the most victims. Where as with firefox having only a small portion of the browser market it just isn't looked at as a target for exploitation.
I think the same can be said about any and all opensource software. I think they are all bug infested, they just have this reputation for being bulletproof because the average user doesn't use them. This keeps them from being targetted by adware creators and people trying to make a buck off software flaws.