Exclude the executable from malware bytes.
Yes, I get that to make the alerts go away I can exclude them. I was not completely aware until now that I had set Channels remote to 'automatic' that then exposed TCP 8089 via UPnP. I had not seen that before on the *ix or shield build because I did not set that (i.e. Tailscale only). Shutting off 'automatic'.
Also if you aren't currently running the channels server on windows, why would you want to migrate to that OS??
Alas, I had a loose Windows computer here that runs most of the time that has a big cpu and thought I would give it a go to see the difference. My other little systems are not Windows based, and (before you say it) I cannot currently afford an Intel NUC
Nevertheless, I get your point.