and they’re absolutely terrified of making any changes that might mildly inconvenience enterprise customers
Correction, they don't think about such changes at all. There are no other concerns than those of big-paying customers, and even then you need a bunch of big enterprise customers request something for the thing to even end up being considered for the backlog.
This is a backwards take.
The only way to have actual security is for the entire kernel to be completely open source. Microsoft is too blame for not giving everyone kernel-level access.