Or they could bundle a basic driver or police the driver they're curating while allowing people to download and install drivers directly from the vendor website with no policing, no signature checks, etc.

Distributing malware is negligent or malicious, yes. Not stopping users from seeking out their own malware is neither. Nothing stops you from running malware on Linux. The curated repos are simply good enough that there's not much reason to go looking elsewhere.

Poor Microsoft, what have they possibly done to deserve such lack of faith??

Well yeah, when you spend a significant segment of your corporate life being both negligent and an evil monopolist, people tend to assume the worst. Don't like it? Behave better.