Wasn’t there something a few months ago about Microsoft handing out secret API calls to developers of other antivirus products so they can quietly disable Defender during the installation of their product? Some guy had this reverse engineered from an installer…