In the case of the browsers, it "only" the bits they tampered with that's more insecure. For their own stuff, anti-virus, firewall and what not, they've "tampered" with the entire code base.
In the case of Microsoft, their motivation is to make Windows work better, in the case of OSS the motivation is often to scratch personal itches, both of these motivations trend towards positive results.
In the case of 3rd party security software vendors, their motivation is usually to upsell you from whatever version you are using to a higher level of "security", so it is in their best interest to go nuts with false positive reports (eg. finding some browser cookies in a scan, posting up such severe looking warnings that you'd think your system is rooted), bog your system down, etc.
(See: https://www.reddit.com/r/YouShouldKnow/comments/40zh69/ysk_t... https://www.av-test.org/en/antivirus/home-windows/)
Think about it: all this stuff is costing them money, and that reduces their profitability. What is it gaining them? Nothing.
Why? Simple: if customers get pissed off, what are they going to do, switch to Linux or Mac? Maybe a few, but the vast majority will just put up with it and gripe and complain. They're never going to leave Windows, so it would make sense for Microsoft to screw them over.
Oh, I got paid for the time, but which is more satisfying and looks better on my resume: "Hacked around antivirus bugs" or "Built a cool and awesome feature"? :-)
Here's my previous rant on the topic with specific details:
https://news.ycombinator.com/item?id=10248084
And a mention of one of the debugging techniques that was helpful here:
You might be interested in reading up on tavis Ormandy and his adventures with Sophos antivirus. He was able to find several holes in sav with [allegedly] very little effort. Which was especially comical because they could be used to pwn Sophos' network firewall product which is used by enterprises.