> they can't create APIs that enable those things and not allow third parties to invoke them.

Entertainingly the same reason microsoft didn't lock down the kernel interfaces that lead to crowdstriking everything. MS wanted to be the only security product in the kernel.