Viruses are simply less common on the Macintosh, not because it is more robust, but simply because it has less market share. If a Virus creator is going to make a virus, they want to target the 86% (or so) that are on windows based machines, rather then the 12% (or so) that are using Macintosh machines.
That being said if suddenly the tables turned, it wouldn't be long before the macintosh was also subject to the brunt of viruses. BUT- although windows updates are always free... Apple charges for the updates. take the number of revisions to OSX. Each of these would have been free with the purchase of the original OSX product, if they followed the MS route. Their "security" is really no better then that provided by an NT-based Windows machine. (and the "classic" mac OS, 9, for example, are so easy to take over (in comparison to XP) that it's almost sad. (they don't get taken over, because they've mostly been "phased out" of usage (not having the hippest coolest Apple product means death for nearly any Mac/iPod owner
).
PCs, as I said, are targeted more often because their are more in use. Because of this almost all hackers/security crackers are running over the Windows security features searching for the smallest problem- perhaps a certain network function can be coerced into doing something a certain way; whatever the cause, It's important to realize, that virus infections, spyware, and so forth, are almost never able to be installed on a PC because of a security flaw or an inherent problem with the architecture, but rather through user negligence- perhaps they thought they were downloading a fun screensaver, or something to that effect. This is social engineering and it's success depends entire upon the person using the PC. the very same methods could, with some modification, be used to commandeer a Mac PC.
The main drawback for windows quite literally since NT 3.1 has been the need to use an administrator account to perform useful task. Run as administrator- and so do all programs you run- and all programs they run, such as an ActiveX control being run my a browser. This makes taking over/infection quite easy even by simply loading a page. MS finally did something about this, as best they could, with the introduction of UAC. The idea is, when a action requires admin permissions, the prompt is thrown up requesting permission and/or credentials. if allowed, the action is performed under the admin account, after which said permission is removed.
