Correction. Microsoft runs its own quality assurance, along with software signing, WHQL, and tools that are designed to test software to the very limits. It's pretty cool stuff, actually, but I won't get into details here.

Point is, however, that the sheer size of software out there is mind boggling. MS enabled driver signing because it takes a driver error to blue screen Windows and the first question 2 hours later was "how do I disable it".

The only way to keep these drones from infecting themselves is to limit what you can install. But this only works for small communities (by comparison) and even so, people jailbreak their devices. Apple tries hard to separate from these people, up to denying support and locking phones so they keep their image of working stuff.

You can't do this for a larger community.

It's funny, security is pretty good on newer Windows systems, yet I still see 8 of 10 issues with Windows are rooted in malware. Right after a cleanup, as I pack to leave, I see people installing smilie packs from pink blinking sites.

What I am trying to say is, it's basically down to one of two things. Either enforce and actively and forcefully harass users into your policy or you go the Microsoft way (would you believe MS would be on the wrong side of this comparison?) and allow disable thus freeing up users to self-nuke.

So few use native security people think there is none.