It's not Microsoft that should wall off the operating system. It's banks, airlines, health care providers that should not use Windows the way they currently do.
No employee there needs the possibility to install any software themselves. Without the possibility to install software you don't need anti-virus software.
These systems should just run immutable images, in A/B deployment, just in case the new image is broken.
Of course that does solve the supply chain security. How do you make sure that the images contain know malware? But the problem does not not need to be addressed on millions of machines with millions of employees. It gets reduced to thousands.
No employee there needs the possibility to install any software themselves. Without the possibility to install software you don't need anti-virus software. These systems should just run immutable images, in A/B deployment, just in case the new image is broken.
Of course that does solve the supply chain security. How do you make sure that the images contain know malware? But the problem does not not need to be addressed on millions of machines with millions of employees. It gets reduced to thousands.