I concur. Unfortunately, Microsoft has forfeited a lot of trust in recent years through a series of user-hostile acts it has taken in connection with Windows 10

I concur. Unfortunately, Microsoft has forfeited a lot of trust in recent years through a series of user-hostile acts it has taken in connection with Windows 10. It's prudent to apply the principle of least privilege with any device on your network, and given those user-hostile measures, a rational response is to consider a Windows 10 machine as potentially hostile and apply similar restrictions to something like a BYOD environment. After all, a device can't compromise information it never has through an external firewall that won't let it phone home.