The only thing you can't disable here are the vulns, technically MS is obligated to patch though so I'd be interested which ones apply, I'm assuming there's a lot of vulns in certain features. My Windows SSD is 60GB fully loaded with apps and drivers. Search and other stuff are just basic config items and plenty of UI replacements and tweaks to be had.
My Debian servers and laptop run way lighter as expected, unfortunately I need the custom hardware support of Windows for some software critical to my livelihood. All I do is deploy Windows in the same way I'd deploy and manage an enterprise workstation. No store, no live, no "apps," no overlay bs or news feeds, just pure Windows. Gotta say I prefer 11 so far to 10, the window snapping and some other changes have been good for productivity, which is really the only thing I care about since I'd switch that machine to Debian in a heartbeat if I didn't have a use case.
AtlasOS is great wish I discovered it before doing it all manually. All it really does is apply group policy changes and config management, which is what any enterprise workplace will do by default. I have 15 years experience as a sysadmin in a mixed OS environment in the operation of critical infrastructure. We're bound by intense regulations and audited often, and Windows is the workstation OS that we can easily manage security-wise. This is in contrast to the notion of Windows as a garbage consumer product, which yeah not wrong there, but people might not be aware of it's compliance with industry standards and security regs. Which is a shame because that's ultimately what's evil about the MS approach to business, they create a problem for businesses and offer the solution.