First, Candy Crush was never preinstalled. A link to purchase it in the Microsoft store was preinstalled, and it took all of two clicks to get rid of it if you wanted to.

Second, preinstalling that link reduced malware infections of windows systems by a visible percentage worldwide.

Microsoft has a duty to protect users who need it. Finding a compromise where the worst case for other users is that they need to click twice is pretty good.