The thing is: Windows and Office is insecure by default. Admins react by sprinkling anti-virus on top of it, but that doesn't help any. It still enables users

The thing is: Windows and Office is insecure by default. Admins react by sprinkling anti-virus on top of it, but that doesn't help any. It still enables users to open random mail attachments in Office or similar. And Office doesn't have any sandboxing or other mitigation in place, again it's insecure by default. If you enable users to do stuff like this, you have noone to blame if you get owned. Are the usual Linux distro's better? Hell no! They have the same flawed security architecture as Windows, only without any motivated attackers (yet). But there are actually secure alternatives: QubesOS and ChromeOS. QubesOS is probably not that suitable to end-users, they can do too much wrong to twart it's security (using the "financial" qube to browse p0rn... etc.). ChromeOS is a reasonably secure OS: It's root filesystem is read-only with tamper-proof authentication, user's home directory is encrypted. Chrome runs with the usual privilege separation in multiple processes each in it's own tight sandbox. There is no way to autostart anything. Even in the nuclear case of a 0-day RCE + chained sandbox breakout + privilege escalation to root, the threat can not persist itself... you just reboot the device and are save again. And Google has lot's of experience in security, they one of the few who build their own browser, the most hostile environment. They are clearly thinking about security front and center and not as an afterthought (like Microsoft).