The thing with the "don't open email attachments" type advice, is that somehow it's not enough (I think it's more complicated actually. You need another bullet point for "keep your browser up-to-date" and/or avoid certain typos of website and certain links. There's several types of traps beyond email attachments) I despair at teaching my old parents how to not get malware infections. They may last a couple of months, but it's only a matter of time before something they do leaves me spending the weekend trying to run virus cleanups. I'm sure my parents' experience is indicative of many other less tech-savvy folk.

But anti-virus isn't the solution either. This happens with anti-virus eating half their CPU. I don't really know a sensible way to let my parents have a windows laptop these days. They use an iPad now, and that's the end of it.

I certainly agree with your top and bottom sentence there. AV software is basically an industry which shouldn't exist (or at least shouldn't be anywhere near as well-known and lucrative as it is). The reason it has existed, is because Microsoft have in been poor on security in general. I think more specifically we can say that earlier versions of windows took an approach of being way too permissive with things like file permissions. It seems to me they've been gradually phasing in more sensible limits ever since, and if they're also phasing out 3rd party AV software, I can see that might be a sensible rationalisation too.

Might be. I'm not 100% sure because, while they are improving general security, the other challenge microsoft has always faced is that hackers target windows first because it's most popular. Previously hackers had a mish-mash of several different AV softwares to stay ahead of. By making every windows machine a highly regularised defender-running target, this might make life easier for hackers.