On the Full Disclosure mailing list there is a (I believe) German guy who regularly posts Windows vulnerabilities - he has been doing this for years (decades?). He always posts some PoC for exploitation, the timeline of his communication with MS, and a timeline of the bug, which usually shows that Windows is and has been full of (sometimes trivial) security bugs, and MS does nothing against that.

I don't want to name the guy here, but if you look through the FD archives you can find some gems.

Anyway, that comes to my mind each time I read some news about MS pretending to be so very security-first company.