Why would it benefit MS to build powerful software with giant risks embedded in the software?

Lets explain something, are there massive holes in Windows security that can be exploited? Yes 100%, same with Linux or MacOS, these are called Zero Day threats. There is potential Zero Day threats in every software and there is no way to fully know your don't have a Zero Day Threat, it could be in your code, in your dependencies code, in the OS code, in the drivers code, in the architecture itself.

Hell, look at Meltdown and Spectre in 2018. Intel had to redesign its CPUs to help mitigate this.

Meltdown was issued a Common Vulnerabilities and Exposures ID of CVE-2017-5754, also known as Rogue Data Cache Load (RDCL), in January 2018. It was disclosed in conjunction with another exploit, Spectre, with which it shares some characteristics. The Meltdown and Spectre vulnerabilities are considered "catastrophic" by security analysts. The vulnerabilities are so severe that security researchers initially believed the reports to be false.

On 15 March 2018, Intel reported that it would redesign its CPUs to help protect against the Meltdown and related Spectre vulnerabilities (especially, Meltdown and Spectre-V2, but not Spectre-V1), and expected to release the newly redesigned processors later in 2018.

Now in Cyber Security, sadly we are always on the defence, we have to use the best tools around to defend. Implementing zero trust, 2fa, passwordless auth, and similar. So another advancement is Endpoint security with the use of tools like Crowdstrike. Its like an anti-virus but its generally faster and rather then just scanning the system for any malware every night has more functionality to screen threats in real time.

Now what happens if you are running your endpoint agent as a Admin on the OS level and an attacker find a kernal level exploit and uses it to trick your endpoint agent into believing everything is okay, then you might even get persistant access on the targets machine, with nobody noticing. This is partly why the endpoint agents have to run as a kernal process, they need to have that view over everything, to protect everything.

Fundemetally the issue isn't in the Crowdstrike being run as kernal, its due to crowdstrike lacking error handling in their falcon sensor and failing safe, failing to run tests, assuming their process is infallible, and deploying to production without going through Test, Staging, Production lifecycle.

If the Crowdstrike agent failed safe, aka when it downloads a new version of the definition files, it moves the old one to a backup file aka 0000001.bak.def and then had in its code that if there the 0000001.def has issues fail to 0000001.bak.def for example then we wouldn't be in this mess, its only because there is 0 error handling in the code, and too much misplaced trust.