I do absolutely agree that having fewer things run at kernel-mode, the better. We've seen the absolutely mess that buggy kernel-mode drivers and hooks can cause before the CrowdStrike clusterduck or even anti-cheat software. Having an auditable layer between kernel and user-modes is ++good.