Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup

Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup (albeit isolated to device drivers) instead of facing regulatory scrutiny. Apple's responses to the DMA/DSA and Google's Privacy Sandbox have already attracted such scrutiny despite providing alternative APIs. I assume Microsoft Legal could already foresee such a situation arising, and just assumed it was better to leave the system as-is until there was a compelling data point to prove otherwise.