There are multiple contributory factors, but there seem to be two main reasons:

1. Linux grew out of the Unix tradition which has always supported explicit permissions and a clear separation between regular users and the superuser ("root"). This limited the scope of damage that could be done by an exploited application. Windows, on the other hand, grew out of a single-user system and for reasons of backwards compatibility accommodated regular programs running with administrator privileges. Those applications can therefore wreak wider havoc when exploited.

2. The culture at Microsoft for many years appeared to be driven to produce feature-laden software even if security considerations had to take second place.

Contrary to your assumption, open source mitigates against viruses. Many eyeballs viewing the source code makes it more likely that weaknesses will be spotted and fixed. With closed-source code, the "bad guys" are still decompiling the code and looking at it, but the "good guys" don't get to see the code.

Regards,
Roger