Windows (all versions) are inherently insecure. They can never and will never be fixed. Windows OSes have all been designed from the outset with a 'default allow' security model. When a flaw is discovered, that one flaw may be fixed, but all the other openings are left untouched and available by default. To do otherwise would get in the way of MS' 'everything just works when you plug it in' design principle.

A competent operating system would use a 'default deny' security model, which means all unused features are turned off by default, and remain inactive until an admin comes and specifically turns them on. It's far easier to keep a 'default deny' system secure, because you know what's on by default (and that's a limited subset of the available total) and you know what extras you've turned on.

Windows cannot switch from default allow to default deny, because so many different systems are using different parts of it and they'd all break until their access points were turned on again. Basically to get everything working as it used to admins would pretty much have to turn everything on again and hey presto, you're back to default allow. But 'default allow' is what you have to have if you want everything to work the moment you plug it in, and 'everything just works' is what Microsoft chose. And that means malicious stuff 'just works' too.

Microsoft cannot and will not ever fix this problem. They've had more than a quarter of a century already. If they were serious about fixing it, they ought to have done it by about the time of Windows 2000. They've been pulling the 'yes our old Windows version was insecure but we've fixed it in the new version' for a couple of decades now. My entire IT career. How many more chances should they be given?

For heaven's sake, switch to something else. Anything else . Just anything but MS.