I'm not going to agree or disagree on this, but Microsoft's choice to shove all syscalls into a DLL where a defined ABI is easier to maintain certainly makes dramatic security improvements to the kernel easier without breaking userspace.