So Win7 isn't affected? At this point in time I have to point out a fully patched Win7, having ~8 hours of support life left, just happens to be more secure than Win10 for trusting certs.
It's called maturity... code that isn't radically changed or added to will asymptotically approach being completely bug-free as all the bugs get gradually discovered and fixed over time. This also implies that the majority of bugs are found in the newest code.