They'd really prefer not to be in the position of force-pushing updates because it's a huge pain in the ass to build and maintain the infrastructure to allow it

They'd really prefer not to be in the position of force-pushing updates because it's a huge pain in the ass to build and maintain the infrastructure to allow it and it generates mostly ill-will and negative press for them (because every user sees the updates, but only a handful of users get their online sites slaughtered by a low-orbit ion cannon made out of compromised Windows nodes). It is, however, pretty much the price of doing business when the business is "Being a dominant operating system vendor." The other ones breathing that rarified air are Android and iOS, and they're about as strict as Windows regarding updates (with the exception of long-tail Android open source builds that are maintained by whatever vendor cobbled something together, which the core project only has indirect influence over in terms of minimizing ability to exploit it as a common-codebase threat vector).