Same with OneDrive's Personal Vault.
Personal Vault is not zero knowledge encrypted. The keys are held by Microsoft and released to your PC for it to unlock the additional BitLocker container when you authenticate to your personal account via MFA. Microsoft can have their way with data stored there as they please and if anyone compromises Microsoft's authentication servers (which has happened multiple times now) it's game over. Everything stored there is still subject to the same server-side scanning too, including processes which assume you're a potential criminal.
If you want equivalent security to what Advanced Data Protection offers, you'll need to use an additional layer to transparently encrypt everything on the client side beforehand, like Cryptomator.
That TPM module that everyone's sobbing about in the Windows 11 thread does the exact same thing in Intel & AMD CPUs.
The TPM does perform a similar initial unlock role, but leaves systems exposed to cold boot attacks. Once BitLocker (Windows) and/or LUKS (Linux) has unlocked access to a volume, the decryption keys reside in RAM in the clear, where they're extremely vulnerable against attacks involving physical access where the computer is switched on or if the keys were not securely cleared prior to shutdown/hibernation.
It's also why BitLocker should always be set up with at least TPM+PIN, otherwise someone can boot a machine and use cold boot attacks to defeat it at their convenience. This is also why Chromebooks
do not use the TPM for full disk encryption but only indirectly (and only where Google's own custom silicon isn't present) in conjunction with the end-user's password.
On Apple Silicon Macs, once the initial FileVault unlock process has completed, cryptographic processing continues to occur via dedicated hardware (namely the Secure Enclave Processor) to ensure that encryption keys are never available in the clear (in RAM) to someone attempting such attacks.
I don't know how Apple handles running a Linux or Windows VM without a "weird virtualisation or container layer," but does the end user even care?
Not talking about actual VMs but the necessity of these things on bare metal installs for no good reason.
Windows 11 virtualises the bare metal install by default in order to provide security features other platforms are able to provide without needing such a layer. VBS, HVCI, Device Guard and Credential Guard were originally only available on Windows 10 Enterprise and caused such a performance penalty on Intel 6th Generation (and older) processors that when Microsoft wanted to force these features to be enabled by default for Windows 11, they needlessly created large piles of e-waste by demanding 8th Generation or newer. End users tend to care when they have to throw perfectly good computers away without good reason to do so. Worst of all, some of the features this requirement supports (like Credential Guard) don't really benefit a home user PC on a workgroup at all. Even with compatible hardware, users actually cared that much about the negative performance impact of these features on self-built gaming PCs (even those with newer CPUs) that OEMs like HP and Alienware pushed Microsoft to allow this security layer to be explicitly disabled by default on their gaming line-ups.
Linux has multiple competing container-oriented package formats which are still inferior to native packages (Snap and Flatpak) that do not integrate well (e.g. broken themes) and require an entire distros worth of additional libraries/frameworks just to install basic components. End users care when basic software like their Mozilla Firefox doesn't work properly because Ubuntu mandated it become a Snap and all that plumbing makes just launching it a pain. Funniest of all is Microsoft copying this stupidity with their latest iteration of the MSIX package format, currently in preview on Windows 11 but expected to be the preferred way to deploy software in the next major Windows release, unless developers shame them into backtracking. If you've ever found Microsoft Store versions of apps to be shitty, well, sideloaded versions of these adapted from existing code using half-baked transition APIs are on the way,
