I wonder if this has anything to do with the fact that gitlab is fully remote.

In an office where you have on-site IT staff, and a local corporate LAN, you can require every windows machine to be part of AD, have group security policies pushed out, and generally have tools available for central management.

But with gitlab, everyone is working in their own networks around the world. That sounds like a very hard environment in which to globally apply the types of security policies that are needed to keep Windows secure.