Microsoft will never phone you to inform you of a problem on your pc. If you get a phone call asking for someone to connect in and fix your computer when you have not asked for this, then it is a scam.
If you are concerned about the “risks” that they have said your machine poses, then note down what they say and thank them for the information. Then say you will get your local IT Company to fix it. They will try and say they will do it for free over the internet. Don’t allow this. End the call and then contact your local IT Company to ensure you are protected.
Your IT Company may connect to your machine over the internet to check things over.
Remember you have asked for this connection….not the other way round.