I would simply disable windows update. It always seemed insane to me that the solution to preventing RCE was to open an RCE channel to basically every provider that has installed a driver or an application on your machine.

Each auto-update is by definition remote code execution.

I've disabled Windows updates since 2017. Occasionally, I'll hit a feature I have to update for, like Windows Mixed Reality, and then pull that specific feature update. I think back in 2021 I had to update to the 2019 version of Windows 10 for that. I used uupdump to download what I needed and install it offline.

All the fiascos lately about Microsoft completely bricking and destroying systems with terrible updates just reinforce my original decision.

Note that I'm not at all hostile to updates in general. I'll update my Mac as soon as one's available, even to unstable betas, because it automatically reopens my apps and doesn't lose a bunch of state like Windows does. I'll also update my iPhone and iPad. It's really just Microsoft that I don't trust and never have.

When I got a new PC desktop, I decided to give Windows 11 a chance, and it's not bad. I hated for a while that the UI feels like just a ripoff of ChromeOS, but eventually I got used to it. I only update the minimum amount necessary when anti-cheats decide my old files are no longer trusted (looking at you, ARC Raiders).

If only disabling windows update were simple nowadays. This isn't the sort of thing that should require people to have to mess around in the registry just to not get spied on

Just stay on Windows 10 and it will be disabled for you!