i vaguely remember their images being hosted directly by Bing, maybe it’s changed?

ADW Launcher Ex 1… not foss but it just worked for me for the last 10+ years

i guess they’re gonna be abused to hell…

it wouldn’t prevent all vulnerabilities so theoretically you can still be pwned but practically that’s going to work for most cases imo. I’ve done this in the past, block everything except for some proxy port then configure the browser to use that proxy, and use nuTensor/uBlock Origin on the browser to only allow essential things.

If you’re talking about Windows 10, install Win10 Enterprise IoT LTSC 21H2 and disable all the telemetry craps. That gives you a clean(?) Windows setup with support until 2032.