Microsoft is the company that approved the software to automatically download and run as admin when a specific device is plugged in. The OEM submitted malware and Microsoft approved it. Both are at fault for letting malware download and run on your device.

In the case of vulnerabilities, MS is fully aware of this happening frequently and has announced they want to do something about it, but hasn't actually done anything about it.