In the case of ransomware though, this really is pointing firmly at the operating system. It's not (generally) insecure programs that lead to ransomware succeed

In the case of ransomware though, this really is pointing firmly at the operating system. It's not (generally) insecure programs that lead to ransomware succeeding - ransomware works so effectively (and is a force multiplier for malicious actors) specifically because it runs with normal user privileges, and isn't needing to "exploit" anything. It runs as a user, and just makes do with the access that user has to files. Before we hold application software to account (and we really do need to), we need to start with the fundamentals - operating systems need to move beyond a "software runs as the current user" model. Otherwise I don't see how we can fix this with assurance/regulation - the root issue seems to be inherent design flaws in modern GUI/desktop operating systems. The tools are there to protect yourself (binary whitelisting, applocker, santa etc.), but they are seen as more inconvenient to use than doing nothing... Hence most companies do nothing, as that's cheaper.