Well, as far as Apache goes it has been ported to windows so you have options there.
IIS in Windows 2003 has been designed with less features installed/activated by default so it should be a bit more secure than IIS on Windows 2000. Having said all of that, IIS is IIS. I don't work with it, but from what I have read if you use the lockdown tool from Microsoft its about the same result. IIS 6.0 does add apache-like text file configuration so if you wanted to reconfigure IIS just modify the file and restart the service.
I guess you may spring for the web server edition, but I don't know about pricing for that. Gotta love *nix + Apache...
---Edited for Spelling---