AndrewC: I'm with DarrkPhoenix on this one.
The stated rationale is a strange one, given that OS X remains an option.
EndlessKnight: You're focusing almost entirely on OS X when the article lists Linux as one of the options. Do you have similar feelings towards it?
I'm not that informed when it comes to
actual Linux capabilities/vulnerabilities when it comes to security to comment on that unfortunately because it ties in the way the apps interact with the kernel/OS subsystems which represent the main points of entry. I guess they could use RHEL with full-SELinux to be as protected as possible but further than that I have no idea.
I know for a fact that a properly configured and administered Windows 7 (I guess even Vista as the respective underlying architecture hasn't changed that much compared to the transition between XP and Vista) box is just as safe as a properly configured and admin'd Linux box.
As I said, in my opinion, Google is dumping Microsoft because they are pushing cloud based apps. They are just using the Aurora hacks incident as a PR push for this.
We also need to keep in mind that the Aurora hacks were targeted. When you're aiming hacks at particular companies, your exploit selection criteria change.
For normal mass-market attacks, you want an exploit that's cheap and widely useful. As a general rule, this means you target Windows and Internet Explorer, and it means that you use patched exploits rather than 0days.
But the Aurora attacks were aimed at specific companies. That changes the selection criteria somewhat. You now have to account for the organization's security policies and platform choice. So, for example, if you know the organization keeps its machines up-to-date, you'll need to discover (or purchase) a 0day flaw. That way you can evade virus scanners and patches.
So as a response to your question, I don't know if Linux is better at security than OS X (I tend to answer yes though due to the SELinux implementation) but the issue is that a determined hacker (team), given enough time and resources can get in no matter the OS. It's just that on certain configurations it takes longer and is more visible. No matter what OS you're using, you aren't safe from a concerted, targeted attack. The whole concept of finding and exploiting a weakness in a specific company's security means no amount of sandboxing, ASLR, DEP or secure heaps is going to keep some hacker from finding either a 0day that works around and/or avoids these measures (XP compatibility mode anyone?) or a worker, who despite all the best efforts, doesn't manage security adequately.
As for an internal view, I don't really see Google employees caring that much (except for those that are involved in app development). The two people I know working at Google told me that engineers are so focused on their projects that their computers themselves hardly matter. They're cranking away on web-oriented projects that have nothing to do with the OS running on their workstation. Their lives are in web browsers, IDEs, and command-line sessions. The apps they build run on various Google-internal OSes. Even within the office, much of the work is effectively done remotely.
Take this with a grain of salt as it isn't first hand knowledge but I sincerely trust that this is the case.