Unix based systems tend to be able to be hardened to a higher level than windows devices. Apple provides a lot of apis for preventing unsigned code from running, which can go a long way beyond a locked down bootloader.

It’s less that they’re intrinsically more secure, it’s just that it’s a bit easier for a determined admin to lock it way further down while also not irritating the user.

I seem to recall Chromebooks are even better, but you sacrifice a lot more.