And we don't use Win10 at all, no sane CIO would ever approve it and stayed in his position for more than a week. Windows 7, no issue paying directly to Microsoft to produce patches long after public support is finished.
I find it awfully hard to believe that you're arguing for using Windows on the basis of TCO, while on the other hand apparently have (and need) a QA department and test protocol that exceeds Microsoft's, and are willing to pay Microsoft to produce patches for an old OS just for you.
You've got 100,000 systems in a highly constrained environment. You pay for the licenses, and to run your own upgrade servers, and to do your own QA on their software, and to get patches for it, and you can't even run the current version because you think it's not "sane". I'm sure there must be external constraints you're not telling us, because this doesn't sound rational.
Based on one post, where I point out TCO is not significantly driven by hardware purchase price? Ok then.
Anyway, the argument of lower TCO cited by the GP comes from (not exclusively) IBM, who I’d say know their own business, also used WSUS/SCCM and claimed they were better off with Apple and Jamf.
The initial purchase price of a machine is near-insignificant to the TCO of a corporate machine.