I agree with your position on security via obscurity being uslesss, but the issue was the settlement didn't allow Microsoft to add limits such as additional validation checks on vendors offerings, as those actions could be construed as violating the "non-discriminatory terms".

Any vendor's legal team worth their mettle could then argue that any additional validation on vendors is unfair given that MS would always have significant internal knowledge about how the Windows Kernel operated.

It's yet another example of the EU getting in the way of itself.