> Microsoft managed to add arbitrary code execution to Notepad.

You write as though this was an intentional feature. Not, it was a CVE. I had to Google about it. For anyone else who didn't know about this CVE: "Microsoft added Markdown (.md) support and interactive hyperlink parsing to the modern Windows 11 version of Notepad. Improper validation of links meant that clicking a crafted hyperlink inside a Markdown file could cause Notepad to launch unverified protocol handlers without proper warnings." This CVE has already been patched.

    > And it all points to a total disregard of the end-user

I don't understand this part. Are you trying to say that because they had a security flaw in a new feature that this demonstrates "total disregard of the end-user"? It seems like quite a reach.

Well that leaves up to almost 50% potentially not written in either language.

And little code can already have a big impact, e.g. react native in start menu coupled with edge running in the background

Aight! Fable 5.1 summary says this is about Microsoft built, self-hosts, and runs in production a proprietary-backend codegen for rustc that bypasses LLVM on Windows. The vehicle is rustc_codegen_utc, an alternative rustc backend in the same family as the LLVM, GCC, and Cranelift backends, wired to the MSVC backend ("UTC").