I like Apache better than IIS, but it isn't so much because of security as it is flexibility. I tend to write a lot of Java servlets and JSP and I like how easily Apache hands off Java processes to Tomcat. So make your decision based on what you need the server to do first, and then by the number of security patches you have to apply second.

But remember, yanyo is correct. You need to keep up with all of the security patches for any software that you use regularly.