This shows just shows how stupid the guys who contract for (EU) government IT, and their political masters who are supposed to be directing them.
Any software that not built from the ground up to be secure is unlikely to be, it is not something that can be bolted on. Various version of Windows needed to be heavenly hacked to meet even the most basic DoD-CETCS (RedBook) standard back in the 1990s. And I doubt it is any better now. That some public services dumped Microsoft years ago suggest this lock-in problem is almost as old as commercial computing.