of course, if Windows used a capability based security model then it would still be a vulnerability that you could do anything you want once you pwn the machine.