I have no OEM bloat, on CTO devices where I can access the drive, I order it with the smallest allowed drive and crack the device open throw the factory drive in the garbage and put in my own WD Black and install Windows from bootable media. For Windows bloat, I install Windows using the English - World option which limits preinstalled MS bloat.
Windows and Office features I wish to block, like CoPilot and Cortana, macro enabled Office files and others are blocked with GPOs.
Between keeping all software up to date, doing firmware updates, putting IoT devices on a separate VLAN, running Symantec Endpoint (say what you want about it, it's been good to me) and practicing safe hex, I'm vigilant but not paranoid about security.
With NVMe SSDs, my cold boot up time on all devices is under 30 secs as well. Fast boot disabled, BitLocker drive encryption enabled.
I have nothing against Linux, been paying with it on and off since 2004ish, it's just not the right solution for me.