All OSes have vulnerabilities, and the thing is MS Defender is a working solution that prevents many attacks. Microsoft also has to provide some nominal support to enterprise apps that are 30 years old, because that's a significant amount of what keeps them in business. Patching actual root causes would often mean changing the way things work at a fundamental level in the OS, and would break apps for a lot of their users. This could create a big problem for a lot of people.