They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.
> Apple doesn't offer a defender-like product, so the move was easier for them.
Isn't that XProtect?
How do they close the kernel and provide API at the same time?
Not a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.