Linux OTOH can be set up so, for example, the MySQL database could only be accessed via 127.0.0.1 if it was only for the local webserver, or opened up only to the hosts that need to access the database server. Furthermore, IPTables could be set up so that requests to TCP/3306 is accepted by the authorised hosts and denied by everyone else, and better still, those hosts would be sited on a dedicated network interface or vLAN so the IPTables can restrict by layer3 port which protects from spoofing.
All of which is irrelevant if the attack vector is a broken PHPNuke or awstats installation. (It seems that web scripts are the most common way in, as they're very wide-spread, not updated regularly on hosts (if upgrading is a pain), and often not audited well.)
From there, you can get a local shell as a user. It becomes an issue of what you can do from there. Wreak havoc as the apache user, for starters, and quite possibly use a local root exploit.
Did you update your kernel? Did you reboot? Rebooting is tedious, and requires a scheduled outage. Maybe I'll just leave it till next week.. Or don't care about becoming root, and just use the box as a drone on an IRC network. Nothing stopping people doing these things on IIS, either. Craig