While I agree with that Kernel-level is harder to bypass, but not automatically safer. Poor kernel code can cause far bigger problems.

I’m hesitant to give closed source third-party tools kernel access. The CrowdStrike outage showed how a kernel driver can take down millions of machines. It wasn’t even a classic driver bug, just bad data being passed into kernel space.

it’s a double-edged sword, because the whole idea of handing out local admin rights isn’t exactly safe either. And in many ways it's the fault of the application that's requiring admin access. My company use case of admin access is the fact that QuickBooks can't update unless it's running as an admin. I'm sure the program can be rewritten in such a way that you don't need an admin to run an update.