In this case the "user" is the system manufacturer who developed an exploitable application, in this case, Lenovo. Lenovo could sell a Linux PC with a similar

In this case the "user" is the system manufacturer who developed an exploitable application, in this case, Lenovo. Lenovo could sell a Linux PC with a similar application that communicated with a daemon running as root which binary was saved in /bin with 0777 permissions. There is nothing special about Windows that makes this vulnerability possible. The end user mistake here was buying Lenovo.