I’m going NC (No Contact) with Microsoft as much as I can without going to a Linux platform.
1) Blocked all Windows updates—a moot point because THEY (MS) cut them off from MY Windows 10 boxes.
2) As discussed elsewhere, 0Patch service which which has already been providing Windows operating system micropatches for some time. NOT to be confused with Oracle Opatch.
3) Settled on WebRoot Secure Anywhere for AV and additional malware prevention and hardening. It’s a solid company that doesn’t get as much attention as it should. Kind of like the security counterpart to Subaru. I’ve been very impressed with it, easy yet intense, small footprint.