That's the sort of thing that should already exist in anti-virus software or host intrusion detection systems. I presume that the university wasn't running such software, or that it didn't work correctly, or that the ransomware was smart enough to bypass it.

IMO, Micro$oft can gain a huge amount of positive press/PR as well as user-love by integrating a defense/protection mechanism right into the OS.

The moment Microsoft try to be proactive and integrate a defence mechanism I would suspect people would then try to hold them liable if another ransomware attack succeeded.

Microsoft could do without the overhead, or the headache, and so despite the PR upside it's probably not worth their effort.

Might be an opportunity for an ISV to make a utility though?

The same logic could be applied to their built-in anti-malware software (Windows Defender), so I don't think that's what's stopping them.