The fact that random companies like Crowdstrike have kernel drivers in millions of computers they they ship remotely is a security risk in and of itself. We're lucky crowdstrike just shipped a bug that crashes computers, other companies could have shipped a lot worse.
Also: don't trust your employees to boot into safe mode.
Trust a 3rd party to freely install system level files at any time.
I knew how to fix the computers at work today in the morning, but we couldn't get through to the help desk to get the bit locker codes for each computer until near the end of the day.
If only our vendors made Linux versions of their systems and regulators would approve them or the OS but no, my regulators only allow windows and approved software that they verify the hashes of every few months for changes