More likely/precisely, it's flagged as malware because it's bypassing protections build into windows credential guard- eg, impersonating(or injecting code into)

More likely/precisely, it's flagged as malware because it's bypassing protections build into windows credential guard- eg, impersonating(or injecting code into) outlook.exe. making an exception for such a heuristic is, in all cases, wrong since it will always be abused. The actual answer is: Defender needs a PUP category.