Linux is open. A good chunk of OS X's internals and the kernel are open. Windows is 100% closed and still has more viruses than both OS X and Linux combined, so how do you come to this conclusion?
Openness has little to do with security.
It's the whole OS design. Specifically, there's two parts: kernel and userland.
The Linux kernel, xnu kernel, and Windows NT kernel are all actually pretty secure. (yeah, you heard that right, I said Windows NT has a pretty secure kernel. if you're laughing, finish reading first.)
A secure kernel is nice. Too bad it goes downhill from there.
It's all the stuff you run on top of it that is where people start to get screwed.
If all you ran were time-tested command line tools on top of any of those kernels, you're probably pretty well off. The attack surface area has been covered pretty well over time. Hence why Linux and OSX are typically fine.
Windows' security is so bad because most people ran as admin. Then install stuff and give it root/SYSTEM privileges, allow it to modify the registry, which modifies the system startup behavior, and then install themselves into kernel modules/drivers to break everything. Oh, and the fancy automation tools your OS gives you? Yeah, any malware author would be nuts not to take advantage of it. There's so many ways in now, and we all kept building more. It's no wonder Vista's UAC was so annoying; all that stuff wasn't supposed to be open that way in the first place. The user's done for.
Linux as a desktop/server OS is fine because much of the tools are built on top of decades old time tested environments. But when you take the secure kernel and marry it to the Android userland, and hand the whole thing off to HTC and Samsung to make strange daemons which allow you to exploit yourself through localhost, then you're hosed. You're sandboxed, but it's leaky. I mean, /sdcard is practically
entirely unsecured regardless of permissions during this time. You're allowing companies who suck at writing software write software that runs as root. You're screwed.
Don't even get me started on the idea of installing 3rd party keyboards. Just think about it. Think about it. What could go wrong with a 3rd party utility knowing everything you type on an internet-enabled device?
OSX? If all you did was run it as a server just like Linux on servers, you're fine. But when you start encouraging people who don't like to read to type in your admin password everytime they need to install stuff, you're training them to just type in their password when the dialog appears. Then that's how you get Flashback. At least you have to type in your password, which is better than the above. But, for users who don't read (most of them), they're hosed. Not to mention installing massive frameworks (Java) and bundling them as part of the OS? Whoops, you know the story.
iOS starts with xnu again, but pretty much asks everything to be signed or go through certain frameworks to do anything with consumer data outside of the sandbox. The sandboxing is pretty good. Until you load an open source framework (freetype) with security holes into a sandbox with weaker restraints (Safari) and then get owned (jailbreakme.com). Thankfully, other decisions make it easier to blow away said OS and restore from an image and restore all data.
But still, you end up with people taking data they don't need (contacts) (Charlie). All you can do is celebrate that while somebody might steal your address book, at least they can't listen in on your calls. At least somebody's worked a bit on securing userland.
Every OS has holes. Every. Reality sucks doesn't it?
Give these exploits all time to simmer, the tastier ones get popular, and that's how you end up with a report like this from F-Secure.