This exactly. I've come across linux systems doing control work in pentests before, and they can be just as miserably protected as windows systems -- possibly m

This exactly. I've come across linux systems doing control work in pentests before, and they can be just as miserably protected as windows systems -- possibly more so, because they're on some forsaken SoC that needs a custom kernel and userland to work, and it hasn't been updated in 15 years, there are privilege escalation attacks galore and the vendor has some backdoor user account enabled. All this to say, Windows isn't the worst thing ever necessarily, and ideally you want a system that's purpose built and only does what is required with the least amount of code/systems possible.