> An app default was reset
> An app caused a problem with the default setting for .png files, so it was rest to Photos.
The OS must not, under any condition, override the user preference - especially, as you say, in case of "malware hijacking popular file extension".
When a program skips this user-respecting dialog, and edits the registry directly to take control of a file extension without user consent, Windows detects it and resets, to give control back to the user instead of letting random software take over. It's part of Raymond Chen's "What if two programs did this?[2]" and "I bet someone got a nice payrise for hijacking user file extensions" comments on his OldNewThing blog.
[1] https://devblogs.microsoft.com/oldnewthing/20170517-00/?p=96...
[2] https://devblogs.microsoft.com/oldnewthing/20050607-00/?p=35...
[3] See also: https://devblogs.microsoft.com/oldnewthing/20190724-00/?p=10...
Let me clarify the scenario:
1. the user modified the default application for PDF to use FoxIt.
2. Win10 reverts the assignment back to Edge after an update and/or reboot.
There is no other program involved. There is a user setting the preference and Win10 ignoring it, consistently for a period of several years, ever since I installed it.
If you are having issues with this, it's probably bring caused by a legacy app or script doing something in a way that is no longer allowed.