I would blame Microsoft for that one, since they had the ability to ban crowdstrike and others who have no business being in the NT kernel from the NT kernel, but instead gave them access by giving them code signing certificates.

Apple on the other hand got them to switch to userspace:

https://www.crowdstrike.com/en-us/blog/crowdstrike-supports-...