The larger number of people also means a larger number of reports about new infections and better optimization of the heuristic detection algorithm and better response time to new threats. You're thinking that the opposite of security through obscurity (which is a really bad idea) applies, but it really doesn't.
The comparison to Mac is not suitable at all unfortunately as you're comparing a piece of software built specifically for virus and malware detection to a whole platform.

Yeah, most people don't have anything to worry about. No denying that. But if you think that Microsoft is on top of exploits then why is it they're constantly releasing updates, sometimes addressing decade old exploits?

Because you can't write flawless code, especially on such a large product like Windows, there are just too many systems interconnected to test for every possible scenario and still release a product. As for addressing decade old exploits, they may (1) have had no potential threat (no harm could be done through them) or just (2) be recently discovered but based on old parts of the codebase.

I'm not denying that. I'm merely unsure where the idea comes from that Microsoft creates exploit-free software. Especially for a free security suite.

Nobody said that MS creates exploit-free software. As for MSE, it has proven to be as reliable as other AV solutions and much less annoying, at least in my and a large number of people' experience.
Who says that the other AV suites are exploit-free?

michaelleung seemed to suggest it. Which, after all, is what started all of this.
Already been over this. The less common it is, the less likely someone is to try and exploit security holes in it. So Microsoft security is more likely to be exploited even if it's twice as good as the equivalent lesser known brand.

And has been proven time and time again through the whole history of computing, security through obscurity never works.

Macs being a case point. But if something is as good (thereabouts) but isn't practically default then you're better off with that. After all, as michaelleung pointed out, it's not like the average user is going to come up against a dedicated hacker, just random chancers.