Security is good and windows is unsecure by nature and have always been and will continue to be.. anyone saying different lives in MS-fantasy land.
But people have to calculate the threat model they have.. are you on a big public network, or in a smaller closed network.. wlan or lan.. does anyone have physical access to the computer and so on and on and on times ten... then you secure the computer for what you need.
The biggest security threat is the person behind the keyboard.. it has always been and will always be.. and its also pretty interesting how everyone say you have to install EVERY patch... okay.. patching the holes is the most important thing.. But why patch RDP if you have ripped out that from the system.. or patch IPv6 if you dont use IPv6.. or why patch an MS-office patch if you using libre office.
Some patches are bad for performance and is way more effective with a workaround(disable etc)..
also one BIG security hole on windows and other OS's is that all firewalls has the setting.. Block inbound as default but allow ALL outbound as default... That is why malware can create a remote connection from inside and out, so the attacker can remote in... Does the calculator really need network access?
So i totally hear you on the TPM and secure boot etc
I dont use secure boot, i dont encrypt my computers... i only encrypt personal/sensitive data.. as i dont get hurt by anyone seeing my bookmarks or can see my movies, or my music or operating system files..