1: https://msrc.microsoft.com/update-guide/en-us/vulnerability/...
Accessibility services are necessarily kernel services, since they tie deeply into considerations of what the OS should/shouldn’t allow the user to do at any point.
Giving the login application its own copy of those services, would mean giving the login application (⇒ applications in general) the ability to tie as deeply into the OS as the accessibility services themselves do. Avoiding that is the whole reason accessibility was made an OS-level feature in the first place!
It’s much easier to have a lock/login screen that ties closely with the rest if the OS, but that’s not an actual requirement. As an extreme example Windows could split things so you have the login screen and the rest of windows as effectively two completely different VM’s that get swapped between.
I am not saying that’s a good idea, but Microsoft is building the OS from the ground up they have a lot of options.
It's a known problem forever because there's literally no solution. You can very well patch lsass.exe to add a backdoor, for instance.
Not sure what the "don't have USB ports" aside was about: plugging in arbitrary USB peripherals shouldn't give you that kind of access, though they certainly are an attack vector.
autoruns have been disabled for USBs since windows xp SP3
Without that, this vulnerability seems to only let you create local unprivileged user accounts which isn't such a big deal.