In many cases, European nations are the manufacturers. Similarly, Microsoft has a program wherein large, security conscious entities such as governments can demand access to their source code so they can run their own audit. PAF has no such system in place, and doesn't have the capability to audit source code. If they actually licensed it from Microsoft, showing their identity as PAF, rest assured they were given software with backdoors. The Americans would not pass a golden opportunity to gain advantage over a nation's airforce.
There is no need for a separate platform. They need to gain expertise in open source software to such an extent, that their personnel understand every single path in the software. Take the Linux kernel, and strip it down to the bare minimum needed by PAF. Perform a full security audit, identify weaknesses and remove them. Now use this hardened version as standard. This is the bare minimum that is needed across all sensitive organizations. Once expertise is gained, then they can think about alternates.