The windows defender service only gives full control to TrustedInstaller (e.g. for Windows update) and WinDefend. However, SYSTEM can impersonate TrustedInstall

The windows defender service only gives full control to TrustedInstaller (e.g. for Windows update) and WinDefend. However, SYSTEM can impersonate TrustedInstaller. Maybe this will change in the future but as of now it doesn't block malware unless the author didn't know what they were doing. IMHO, it's wrong to say that TrustedInstaller and WinDefend have "higher privileges" to SYSTEM as that is only true for specific files/executables and in most of those cases SYSTEM can take direct control even without impersonating them.