Designing malware for windows is trivial. The NT kernel is designed to be unsafe. All you have to do is call certain win32 functions that will cause the kernel to call itself and you can do whatever you want.

Even without this hilarious security hole windows has no concept of app permissions. Antivirus's are a joke, they can't tell what is goodware or malware. Anything that can gain user space privledges can compromise the whole system under windows. They disable file extensions by default and make it easy to use fake ones. "Hey look at this report - exereport.pdf" or a dozen other executable extensions.

Adobe should be liable for PDF exploits as well. Start fining and fund a security org with it.

This is all documented in even basic tutorials. Windows is still what they designed back in the 90's. It doesn't get scrutiny because it's all closed source and has big political ties.