I suppose that it could still be done by "unlocking" the device by logging into MS servers, similar to the Activation lock on Apple devices: Malware can't "remove" the information… but Apple.com can.