Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.
"but I meant good "is totally going to save you then.
Considering you're using a vulnerability to forcefully inoculate systems, and you gained admin if not Ring0 privileges, you could trivially "reboot" the box by just crashing it, no APIs required. You could even be nice and check if there are applications with open files, or schedule it only when the user has been idle for a while, and only do it during the usual hours of inactivity (Windows 10 even has a control panel section to choose them).
Or, you could just open a dialog box, masquerade as a legitimate update and ask for user consent. You are an important security update after all, just a fairly unconventional one.
shutdown -f -r -t 60
Bonus: Also works remotely, there is a flag to give a remote computer name.