The practical difference is that keeping on top of the Win10 vulns would take considerable effort, whereas exploiting (a stock install of) Win2K is “download Metasploit and run this one line to get a remote SYSTEM shell”.
The argument is not that 10 is better or even more secure—surely all the added code has to count for something, although the (glaring absence of) security engineering in 2K gives me a sense of vague horror—it’s that running the latest 10 probably makes you substantially faster than the slowest camper, even if it doesn’t make you faster than the proverbial bear.
