You're right and wrong. I know about a team that does well and one that I think is begging for a major CVE.

Microsoft is said to be a collection of almost independent companies sharing a domain and a CEO. Based on my experience, small as it is, I can believe it.