Even if they did get rid of most MS products. Some senior guy probabbly fires up windows and installs a dozen search bars.
I knew a guy who served in the gulf, he was pretty high ranking, handled some security stuff. Got a request from someone important to basically break all the rules because important guy didn't want to walk too far from his CHU to make a call home.... but he was high enough ranking so they did it. It wasn't even a far walk.
A "security expert" at a F500 once showed my a web page on his laptop. Only 40% of the page was visible due to his 7-8 search bars.
Better would be both. You have a strong, open base, like Linux, but you modify it, so you habe a second level of defence.
But you will have to do more by hand and yes, then there is also a chance that you mess up those patches and create new vulnerabilities. But if you have a big budget ... like if you are a big military and security really matters, than it is probably worth it.
End of the day, policymakers are more educated with economics than cybersecurity and computer science. They probably still gonna use Microsoft products.