To be fair, 3rd party antivirus software often has kernel modules analyzing files. And that TTF font vulnerability recently was stemming from the font rendering

To be fair, 3rd party antivirus software often has kernel modules analyzing files. And that TTF font vulnerability recently was stemming from the font rendering engine interpreting turing-complete font descriptions in kernel mode. And fonts come from untrusted sources of course. So there are precedents for direct paths from untrusted sources to SYSTEM or kernel space execution environments.