The moment Microsoft try to be proactive and integrate a defence mechanism I would suspect people would then try to hold them liable if another ransomware attack succeeded.

Microsoft could do without the overhead, or the headache, and so despite the PR upside it's probably not worth their effort.

Might be an opportunity for an ISV to make a utility though?

The same logic could be applied to their built-in anti-malware software (Windows Defender), so I don't think that's what's stopping them.