A lot of NT hardening happening over last ~20 years was effectively enabling access controls that were set too lax previously or even disabled, all due to performance issues (GDI being moved in-kernel, with all the security issues, was also due to performance problems of NT3.x)

The NT kernel is quite nice and solid, the problem is that not everything built on it followed all of the design rules.