You mention Microsoft at the same time that multiple EU governments are moving away from Windows and Microsoft Office and recommending businesses to do the same.
That usually ends up as proxies to the upstream repos, because the people managing the company repos don't have time to review every new version of a package.
At that point you're just as vulnerable to a supply chain attack.
Low level employees are always taking far bigger risks in relative terms, the worse position a CEO will be in if all of his "risk" hits him is that they'll have to become a regular low level employee.
JS as a language is part of the problem because the standard library is so minimal that people need to use a lot more 3rd party libraries than they would in most popular languages.
Windows is a small part of their revenue on purpose, because the OS monopoly enables them to sell and push a lot of their other revenue streams. Windows has always been easy to pirate for the same reason.
But make no mistake, it is very important for Microsoft and leadership, or they wouldn't keep updating it so much and talking about it so much on their keynotes and marketing.
None of them care about states rights, they just want to control things directly.