If the matching of the signatures is bypassed because of the ability to manipulate the underlying control flow of the API via something like ROP, it could be us

If the matching of the signatures is bypassed because of the ability to manipulate the underlying control flow of the API via something like ROP, it could be used for many things. RCE in Windows Doesn't mean control over digital signature validation. But RCE in that particular API might mean both