If you build a public facing server, you should be familiar and comfortable with the system you are using.
You mention virus protection as a reason, which suggests to me that you are looking for "security as a product", which is something that doesn't exist. Security is always a process, and servers on public networks need to be monitored and maintained constantly -- this is true for both Windows and Linux.
The keys to reducing the work load doing so are
- minimizing attack surface
- automatisation
I've found that to be easier to do in Linux/Unix environments, because Windows's greatest strength, which is the tight integration of components, is actually a hindrance here.
It is completely impossible to build a Windows system that does not have a web browser component installed (which includes functions to download and execute JavaScript code, which can in turn then load ActiveX components), simply because Explorer requires that component. An ideal server environment contains only the code necessary for the services provided, and nothing else.
At the same time, integration of components provides very efficient communication channels for the use cases they have been designed for, but for automated monitoring of services, it is often required to combine them in unanticipated ways, which requires scripting. The Windows philosophy that the scripting environment only provides control flow and data is passed between components is a sound one, but slightly more difficult to debug than a program writing a text file which you can manually inspect before passing it to the next program.
The preference many administrators have for the command line is simply that it is the same language they use for scripting. After investigating an issue, I can simply dump my command history into a file, remove a few irrelevant lines and I have a working script I can use when a similar issue appears. Using a GUI, I'd have to manually retrace what I just did, find out what the proper API is to perform the same step, then write a program and debug it without interrupting service.
Last but not least: the alternative to running your own server is to get a managed server, where someone else is tasked with the ongoing maintenance. They can do that more efficiently than you, because they have a monitoring infrastructure in place already, so the effort to add your server to their system is negligible, and they can detect and take care of urgent issues even on the night shift.