Re: Root kit
Me thinks that you doth giveith our dear friends at Redmond just a tad too much credit in this regurad.
For instance, if you are writing device drivers, you have to digitally sign them so that Windows will allow them to run with the require privileges:
https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate
Code signing isn't exactly a new idea, for example, it has been built into .NET for a number of years.
This is to say nothing about the virtue, or otherwise, of Microsoft's business practices (past and present), but structurally, I think their code is pretty solid.