"but if it did, Microsoft would win it."<p>There is a difference. It's much easier to upgrade Google's applications than Microsoft's. When Google patches Gmail, it takes a couple minutes for me to enjoy my corrected version. When Microsoft issues a correction, it could take weeks until it hits the Windows Update servers and that could easily turn into months before many businesses incorporate it into their update sets.<p>It's not only the size of the attack surface, but the time it remains open. There is also a huge factor in public perception - people perceive their computers as imperfect mostly because they are astonishingly unreliable. If Google can make people happier with their computers and web applications than they are with Windows and desktop apps,  Microsoft will have a huge problem that may not be solvable by throwing money and people at it.