how the IT team tries to justify being locked into Microsoft, and then telling me I could potentially become a point of vulnerability
Because they can manage and control all the windows PCs , pushing updates automatically, restricting what users can do locally and on the network, they have monitoring tools and whatever antivirus and antimalware tools they have, and are able to easily manage and deploy/remove software and associated group licensing and so on and so forth.
Meanwhile you’re a single user of unknown (to them) capabilities that they now have to trust with the rest of their system, basically.
The first rule of corporate IT is, “control what’s on your network”. Your PC is their concern still, but they have no effective control over it. That’s why they’re being a bit of a pain in the ass about it.