You can create an appropriate API to run the code outside the kernel. Nobody is forcing MS to run everyone's the security code in the kernel, MS choose to (because it's easier). The law is about fairness and equal access for all. Apple and Linux have shown alternatives.

Sure, it's safer if only a single vendor is allowed to do this but it's also unfair.