And if it were ten open-source projects then they'd have to defend themselves against nation-state attackers. They're not ready for it. The researchers that demonstrated an attack on Linux got vilified instead of the maintainers that had misplaced their trust. *Researchers* not a truly sophisticated and a well-funded threat actor. Do you see the issue?

Do you really think the alternatives are more diligent with their defense, 2FA, have spent as much time and effort on security?

I truly don't like Microsoft but this seems like shitting on them but I really don't see the point. Anything they use is going to be a "national security threat." I'd gladly see other vendors stepping up, but it's enormously difficult and we're not really there yet.