To the extent that this is true, the lesson is very much not that Microsoft should have had total control over what users were allowed to run.