i once heard an IT guy said that it was due to Mac OSX being based on open source code that anyone can look up. Geek folks love to pour over the code and look for potential flaws. and then announce them to everyone. So the holes get fixed before they get bigger.
That's true but it can also be a liability since Apple has been known not to update the code when vulnerabilities are found (until years later).
So you check out the changelog of the open source code and then you try to attack OS X with the security issues mentioned. It's always nice to have a roadmap