but is a pretty good guideline :) If Windows got ransomed every time and MacOS is never, that is interesting, right?

Windows holds perceived monopoly on company-wide identity control. There are Mac solutions: https://www.jamf.com/products/jamf-pro/deployment/