Microsoft has done a LOT for security but it's not quite properly done yet.
EMET is an example of a great idea implemented poorly, it should be built right into the kernel.
Still, vulnerabilities will literally always exist. It's up to the OS to assume that the machine is compromised and then keep the damage to a minimum.