So they did this and... it looks even worse.
The meat of this blog post, to me, seems like the terrible hiring pipeline with no feedback. That seems like a really bad experience. I can only imagine that someone really dropped a ball somewhere.
It reminds me of the way secure boot was rolled out where Microsoft said that this was all about "trust" and yet OEMs who are always keen to keep Microsoft sweet would strangely only bundle windows keys.
They could have approached the project owner, said they'd like to use the structure under the MIT license and offered a job/cash as a thank you for his dev time.
They could at least send the guy a fish, if his contribution was significant.
I wonder if things would have been different, if the product was licensed under Gplv3. If so, he could demand to check if Microsoft violated the license https://www.gnu.org/licenses/gpl-violation.en.html (to check if this is a completely new rewrite for example).
Update: Ah looks like Winget was sourced in C++, and Appget is in C#