Because DoD isn’t concerned with the regular internet or unclassified machines as much as with the classified computers - those set up by Information Technician ratings and the Security Managers to handle SIPR and JWICS access. The Admirals, Generals, and O-6s are also often tech illiterate old men, and those just beneath that, and the E-7+ crowd, are often just as tech illiterate. Microsoft also has a lot of multi decade DoD contracts, which they get billions for. Microsoft can’t sell the secure version because that just lets foreign adversaries reverse engineer all the possible vulnerabilities. Microsoft only cares about security as far as they get paid for it and can get away with. In the consumer market, that’s pretty much zero concern - not profitable enough.