It appears at least on MS Defender and Symantec End Point security, the VBScript is ignored in the Startup folder.
There is a way to add a user-specific registry entry that doesn't require Admin to add a Windows startup process. This works with these AV programs running. To do this, I used the npm module winreg. If you'd be interested in a way to register a platform specific override for the platform strategy, and a new strategy, I can put together a pull request.
It may require an alternative 'export' style.
Thoughts?