Every user downloads and runs arbitrary code constantly, as updates. In the far future updates might come with a formal proof of their security, machine-verified on download, but for quite a few years still we will be stuck with just cryptography.

A front door would be using Microsoft's signing keys. As long as you don't leak the keys, you aren't diluting security in general. A back door would be just leaving vulnerabilities around. It's a meaningful distinction.