What is the most secure way to address an unused Windows service so it cannot be exploited by malware?

Firewalling a service restricts network-level access but does not prevent local exploitation or direct interaction with the service process from within the host.

Setting a service to manual startup still allows any sufficiently privileged process or user to start the service on demand, leaving the full attack surface available.

Disabling a service prevents automatic startup but the service binary and configuration remain on the system, allowing a privileged attacker or malware to re-enable and subsequently exploit it.

Uninstalling a service removes its binaries, registry entries, and configuration entirely from the system so there is no code for malware to exploit, re-enable, or interact with - this is strictly more secure than disabling, which leaves the service present on disk where a privileged process or attacker could re-enable it.