Not long ago I remember coming across some discussions about upgrading SChannel (the actual TLS component in Windows) in older versions using OpenSSL or other TLS libraries, but can't find at the moment. The advantage of doing so is all other apps going through WinInet automatically get the upgrade.

One solution that works network-wide is to use a MITM proxy; I run one mainly for adblocking and filtering, but another feature it has is automatically upgrading TLS requests to the latest version it supports - currently TLS 1.3. Unfortunately, thanks to Big Tech's monopoly, I get blocked by many sites because the requests it makes doesn't look enough like an officially sanctioned browser, which is another thing I need to get around to fixing eventually.