Pretty sure the TPM requirement was just an excuse to sell new PCs. They ended up allowing older platforms for 11
Though it is definitely not required, IoT LTSC does not have these requirements.
Most of the security improvements shipping in Windows are leftovers from Xbox, but they very clearly state that Windows Security does not treat the user themselves as a threat.
See the slide around 4 minutes into this talk: https://www.youtube.com/watch?v=U7VwtOrwceo