The transformative factor seems rather clear. People want the many altered things and consider it different enough to go out of their way to find it (despite it not reducing their out-of-pocket cost).
The nature of the work is that it is a tool rather than a work of fiction which is also in favor of fair use.
The amount taken is substantial, but it has already been ruled that even 100% taken can still be fair use. It also contributes a great many man-hours of work though which means it wasn't just a blind copy/paste either.
The effect on the potential market is the big thing here. MS would claim they lose money by not being able to spy on users or show them ads. However, their licensing scheme remains untouched which seems to indicate that theft is not a motivating factor. Considering the use of the new work, it could be argued that ads and telemetry would be blocked by a DNS filter anyway and no actual profit would be lost. Further, those people would have moved on to the free alternative Linux which is already the defacto standard for a lot of pen testing and event the license profit would be lost. Then there's the question about if collecting that data is even legal (I don't believe it has ever been tried in court) and how that would interact with the DMCA.
It really doesn't seem like a case MS would really want to go to court over.
