The scanner is a Ring 0[0] program. Windows only has 2 options 0 and 3. 3 won't work for any kind of security scanners, so they're forced to use 0.
The proper place would be Ring 1, which doesn't exist on Windows.
And being a kernel-level operation, it has the capability to crash the whole system before the actual OS has any chance to intervene.