yup.

also: it was microsoft's business decision to make the api required for av (or, more general security subsystems) to function so low-level that it has to be delivered as a kernel driver and operate in ring0. i guess it's primarily for the performance reasons, but still, there are other technical options. someone made the executive decision there.

on the other hand, it was crowdstrike's business decision to make the bloody update parser run in ring0, and without verification that the update data is correct, nobody forced them to do it that way.

let them both burn.