You can enable controlled folders on Windows: https://learn.microsoft.com/en-us/defender-endpoint/controll...

It's not enabled by default, though. Enabling it by default would probably break just about every Windows program out there and like UAC on Vista, everyone would turn it off immediately.