Microsoft acknowledges vulnerabilities, accepts CVEs, then declines to patch them — while earning $20B annually selling security products for the same attack surface. The servicing bar isn't engineering policy. It's revenue policy.