But you don’t. Because you don’t.

Nobody does. Windows is closed source and its inner working is a trade secret. This means you cannot know how to lock down windows. Of course there are best practices based on info from microsoft or people who know a thing or two about info sec but it’s all guess work and/or trusting the developer by its blue eyes.