I don’t necessarily disagree that there are disadvantages as well that said I got by far more often root on boxes due to core server or application level vulns

I don’t necessarily disagree that there are disadvantages as well that said I got by far more often root on boxes due to core server or application level vulns on Linux machines than system on Windows boxes through an IIS vuln (app vulns are still a problem as well as running your worker services as privileged users but that isn’t related to http.sys) since those are more often than not patched.