Readers here are all very likely to appreciate some links alongside statements, cause really this is a sensitive topic. Both statements need certain context as it seems it’s not the universal understanding of what goes on and how often.
That would be a citation. Do you have a link?
https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=10...
https://devblogs.microsoft.com/oldnewthing/20230324-00/?p=10...
https://devblogs.microsoft.com/oldnewthing/20220613-00/?p=10...
For code injection into applications that don't load third-party DLLs as plugins, see, e.g., Microsoft's (unsupported) toolkit for runtime API interception: