Any computer which is on the web can be accessed, regardless of the OS.
I recommend putting a firewall on (I use Firestarter, personally). I
get about 5-10 hits from outside computers a month, but I've never
actually had anyone able to hack into it (though it appears that some
bored guy at MIT keeps trying to get in, every couple of weeks,
according to Firestarter's log).