I think some portions of the company do want to buy these studios to make games. Mostly because they need a regular funnel of titles to put on Game Pass, and the best way to do that is small- to mid-budget games that can generate hype. But then other portions of the company want to chase that big AAA paycheck because big numbers look good, even if ROI isn’t as good for that one game versus 3 or 4 smaller titles. And others still only care about what will make the balance sheet look the best for the quarter.
Even smaller companies end up with various “factions” within the org as far as vision and how to best create success (or even how to define success); a company like Microsoft is so fractured that different divisions are unaware of each other’s goals and have competing interests.
I’m not trying to defend Microsoft here, I just think this is a consequence of an overly large organization that doesn’t have unified goals.
Is the token not keyed to a specific source? I would have expected it to operate similarly to an SSL cert, where part of the verification process is that the source is the correct origin that the token belongs to - so if someone just lifted a valid cert to put into a malicious one, it would catch anything from changing a single character in the project name to changing the repository host (i.e. GitHub to GitLab)