1 article on this topic.
Check Point Research reverse-engineered BTR.sys, the signed Windows Defender remediation driver, and showed how it can delete or overwrite security software before other endpoint agents even start.