They acknowledged that the Windows 2000 design was also used in XP (https://www.computerworld.com/article/2539986/microsoft-conf...), but Vista and above used NIST algorithms defaulting to CTR_DRBG, although the problematic Dual_EC_DRBG (which was flagged by their own cryptographers as problematic: https://rump2007.cr.yp.to/15-shumow.pdf) was present until the Snowden revelations.

Windows 10's (and 11 and probably above) implementation of CTR_DBRG is different from Vista-8 though, mainly in the entropy generation and the switch from AES-128 to AES-256.

It's a good paper, but note that this is an attack on the (old) per-process RC4-based WRNG, not on CTR_DRBG. The attack essentially observes that if you get RCE on a Windows process and capture the WRNG state, you can get all previous and future states bounded by when the per-process WRNG reseeds (the seeding process reads random bytes from KSecDD, a sort of Windows equivalent of /dev/random).

The Windows design is interesting in that it runs a userland CSPRNG for each process, rather than a single kernel RNG like Linux/Unix provides, but still binds those RNGs to the kernel RNG. This seems like a good idea at first, but turns out not to be: the attack wouldn't be possible if KSecDD was the entire CSPRNG interface for Windows.

Unix also provides many userspace PRNG, for performance or other reasons. But programs have the option of using the kernel directly whenever security matters. Is it even possible on Windows to query directly to kernel randomness with documented APIs?

The 2007 papers predate the Win10 design linked by the grandparent comment. I haven't read the 2007 criticisms recently, but have read the Win10 design many times. I don't think there's anything objectionable in the current design.

Edit: I guess the criticism about the generator running in user mode is still true, although I don't think it's the flaw the authors do. Also, I think the current design adds forward-secrecy / key erasure vs the criticism mentioned in the 2007 paper. I believe the O(2^23) attack described is gone now.