Exactly. Windows Defender comes with Windows for free, and does a pretty good job protecting home users. However, ransomware is still the most prolific cyber threat for home users, and Defender can't do much against it if the malware executes before Defender can stop/detect it.
Integrating OneDrive automatically for Photos, Documents, etc, can seriously aide in protecting those important files for end users, since the un-encrypted versions of their files will still be available on OneDrive after a successful attack.
What if Defender was only an option for Microsoft account users? Then it'd be "look at these greedy assholes that just want to collect all your data", when really it'd be an effort for them to protect the reputation of Defender by forcing full functionality by default.
I'll preface by saying I'm glad Windows Defender doesn't do this automatically, but there are security software suites which do provide some protection against cryptoware but at the cost of performance. They tie into the write commands at the OS level and cache the changes while it watches the behavior. If it thinks the actions are probably malicious, it locks out those flagged processes from being able to make any additional file changes and rewinds all the changes those processes have made.
I've yet to actually have it work in in actuality (I have never experienced a ransomware attack either professionally or personally) but I've definitely experienced secure delete programs attempt to do a low level overwrite with random data get interrupted by such systems. I once told sdelete.exe to wipe an entire directory. It furiously ran, did a bunch of disk IOPS, halted a minute or two into the process due to a permissions error, and all my files were fine. A second or two later the security software notified me of a cryptolocker infection it prevented and happily showed me the command I had entered moments before.
Its no free lunch though. IOPS performance is a little lower and there's more CPU/RAM usage per IOPS when the protection is on.
