I'm speaking from the point of view of Microsoft as a user of open source software. Microsoft is not the end-user, but they are taking open source code and using it within their own product, Windows.

Microsoft has the freedom to modify the OSS components in Windows to patch security vulnerabilities.

Your copy of MS Windows is free? And by what logic open source parts of it are exempt from any expectations of support?