> it's still sitting below user space and can do whatever it wants to the system. I don't know much about the Endpoint Security extension, but for Apple's netw

> it's still sitting below user space and can do whatever it wants to the system. I don't know much about the Endpoint Security extension, but for Apple's network filtering extension they actually DO address this! The code that runs on every network call is heavily sandboxed and can't communicate at all with the outside. Its only action is emitting some basic signal like "block" or "accept". This means that while the system extension can evaluate all your network communication, and block what it chooses, it can't exfiltrate the specific content. I might have the details wrong, but that's the general intention. But the security benefits aside, I think the real reason for preventing code from running in the kernel is about stability and not security. Buggy code won't crash the system anymore. They can also enforce stricter performance requirements. (And at the moment, you can still run kernel extensions on your own system if you really want by disabling SIP and other things, it's just infeasible for any AV vendor to have their customers step through that very onerous process.)