There within lies the problem with the argument. ISS contains more than just HTTP/s serving. If you really wanted to get technical, you should combine the statistics of other free server service alternatives that people use to have the equivalent services that ISS provides.

As far as enterprise implementation, the reason why bank, large companies, etc use ISS or something similar is that they can sue the crap out Microsoft if the system is compromised. In every large company/organization I have ever worked for, I have asked why they used commercial products such as ISS over open source and the answer has always been “to have somebody to hold liable when it all goes down.”