They'd really prefer not to be in that position, but they learned the (extremely) hard way in the early days of the Internet that when you have the largest OS install-base (And MS still has like 29%), you have some obligation to the global community to police it. Because Lord knows individual users don't pull upgrades in fast enough voluntarily, and an exploit shared by 29% of computers can be easily weaponized online.
The Internet would be much, much worse if not for the steady drumbeat of OS vendors forcing users to patch vulnerabilities via upgrade pursuasion.
(At least until someone finishes development on that vulnerability-free OS. What did they call it? NonexOStant?)
What makes you say this? If I was MS I'd be perfectly happy to effectively own most computers on earth and be able to do anything I want with them.
It is, however, pretty much the price of doing business when the business is "Being a dominant operating system vendor." The other ones breathing that rarified air are Android and iOS, and they're about as strict as Windows regarding updates (with the exception of long-tail Android open source builds that are maintained by whatever vendor cobbled something together, which the core project only has indirect influence over in terms of minimizing ability to exploit it as a common-codebase threat vector).
(Optional: "It owns you" ;)