They can claim admin-to-kernel is not a security boundary all they want, so long as driver signing and Windows side secure boot is supported, it is a security boundary.

They do this quite a bit like with powershell exec policy or many uac bypasses. According to msrc policy, only non-admin user accounts where the user does not know the admin password have a security boundary between them and the kernel. But in reality they offer many security features users rely on and most users don't have a choice but to admin their pc in some capacity