The fact is that Microsoft has continuously improved its process for the past fifteen years while being the most exposed company in IT.
Backwards compatibility, including keeping arcane and dangerous features, is the killer product of Microsoft and companies value it enough to accept increased risk exposure. That's all there is to it.
>The design of Active Directory, Office macros, PowerShell, and other tools has enabled successive generations of threat actors to compromise entire environments undetected.
And SSH and Bash contribute to arbitrary remote code execution !