That is true. The issue is that because there are so many permission escalation issues in windows, that many anti malware products must run as kernel drivers.