I imagine it’d be more like Android/iOS. Lock down bootloader so you can’t tamper with the OS, enforce notarisation requirement so that apps have to go through them. But Microsoft can’t do that, they don’t have any users vendor-locked to their application store. Valve on the other hand is in a much better position to do this.