It does have that. Windows uses code signing and either DISM or SFC to do that.

But this isn't about the binaries. It's where definitions and configuration are stored. It's C:\ProgramData, not C:\Program Files.

The system also can't object too severely. Third party endpoint protection exists.