There are always going to be security holes in complicated systems. (Not just ones written by Microsoft).
However at least microsoft have tried to take steps to minimalise the risk by adding UAC and other small steps.
If people use the OS correctly i.e. not logged on as Administrator all the time
and have UAC enabled there will be less risk of getting problems.