Microsoft started from a point of having such terrible security that was practically impossible __not__ to improve. The point is that, despite all of the work

Microsoft started from a point of having such terrible security that was practically impossible __not__ to improve. The point is that, despite all of the work they have done (and they have done a lot) they still have a very long way to go to make up for 20 years of completely ignoring security engineering.