Along with CrowdStrike’s post incident review, this has Microsoft telemetry data and some explanations (performance, tamper resistance) for the kernel driver architecture that crashed millions of Windows systems.

Microsoft has called for locking down that access, and this post again brings up alternate options:

...security vendors can use minimal sensors that run in kernel mode for data collection and enforcement limiting exposure to availability issues. The remainder of the key product functionality includes managing updates, parsing content, and other operations can occur isolated within user mode where recoverability is possible.