Tinfoil theory incoming: NSA pressures windows to have the largest attack surface possible by default. With the hope that any given targeted system will have at least one piece of default bloatware still running, presumably they have 0-days for most all of them.

Even putting aside the tinfoil hat. The NSA would never pressure anyone to have a larger attack surface, that would just make it easier for competing nations and attackers to discover flaws, which would render their own efforts moot

They have compromised crypto standards in the past, but we can't use that to justify every conspiracy theory without evidence.

if Russia discovers how to hack Cortana and keeps it private, that in no way impinges on NSA's ability to use the same hack to compromise, say, an Iranian system. The more possible avenues for attack, the better (for attackers).