Having managed desktop windows deployments, I sort of agree. They work pretty well up to a point and that point stops when you have to introduce change control. Eventually all the little hacks, GPO scripts and stuff piles up and up and up and then there's a task like "migrate one AD node to 2016" and this turns into a 2 month project unpicking all the hell.

That is what every single Windows environment I've seen turns into, including the SCCM powered and Microsoft direct consultancy managed ones.