Not true. 7th gen gained Mode Based Execution Control which greatly decreases the overhead of VBS. 7th gen also gained SMM Security Mitigations 1.0 and some UEFI hardening.