Not all bugs are equal, especially when it comes to security bugs. They may range from "oops, I forgot to check an array bounds" versus "the entire implementation is fucked due to a bad architecture and we have to rewrite from scratch to fix this".
I'm stating this with no judgment on either OpenBSD or MS. Ive used OpenBSD in the past, and I've a lot of respect for them. I also work in a heavy Windows shop, and I appreciate MS's desire to fix issues while maintaining backwards compatibility. Doing so for MS often involves horrible hacks when 3rd party software relies upon either undocumented internal APIs or broken APIs. Prime example is the current battle with Win10 and anti cheat software causing green screens.
I'm stating this with no judgment on either OpenBSD or MS. Ive used OpenBSD in the past, and I've a lot of respect for them. I also work in a heavy Windows shop, and I appreciate MS's desire to fix issues while maintaining backwards compatibility. Doing so for MS often involves horrible hacks when 3rd party software relies upon either undocumented internal APIs or broken APIs. Prime example is the current battle with Win10 and anti cheat software causing green screens.