> on Windows you have a system where the default way is to let the user control the software and install random things, and you need to patch that ability away first.

That's certainly not the default in a managed corporate environment. Even for home users, Microsoft restricts what you can install more and more.

And restrictions are not implemented via patch, but via management capabilities native to the OS, accessed via checkboxes in Group Policy.