by Guillermo Madero.
Hello Ethan,
Unless those "security holes" are listed and explained, it is useless (in my opinion) to worry about "them". There are always security issues everywhere, in every OS, in every web server and in every browser; some deal with them and some not, but everything keeps moving on.
I'm not particularly knowledgeable with IIS and MSSQL, and so I prefer Apache and MySQL, but I've had Moodle installed in different Windows servers, from Windows Server 2003 to XP, and from WISP to WAMP. So far I've never had major problems, maybe because I'm not into major leagues and the installations have always been small.
I would definitely recommend you to install each component by itself, that is the most secure way of doing it.