its choosing software components based on known security vulns

You don't swap GUI's on 1,000 corporate users every time a new exploit comes out. You don't know which Window Manager or DE is more secure.

Besides the Window manager is rarely relevant to exploits the same as in Windows. DirtyCow, CVE-2024-1086, SSH, this entire list https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 didn't care which Window Manager you ran.

virtually no "average" linux user, then or now, ran/runs as root.

That's because Linux users already know about computers. In 2003, at the time of XP Linux distro did not disable root. Root was the default during install. You then had to create your own non privileged accounts. In some distros that meant using useradd.

because of deep, baked-in design choices made by microsoft for windows XP

The exact design choices of Linux at the time.

You have a double standard.