Kexts are being phased out, and are only changeable if you "reduce security" though, so obviously not something that Apple is supporting, it's more "at your own risk" so not really the same as what Microsoft is doing (Supporting people plugging into the kernel itself)

Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.