They do this. Because without doing this to anyone except who is capable to opt out this by jumping through all the traps they setup. There will be countless of vulnerable devices for ddos network to use.(or countless of victims of ransonware)
There are shit tons of "optimized" windows install disk in the past with disabled security measures for "performance". And Microsoft is intentionally make these harder to make.
