It’s a third party kernel module, which Microsoft would love to be able to block, but legally can’t. It’s technically possible to write a virus scanner that runs in user space instead of the kernel, but it’s easier to make sure everything gets scanned if it’s in the kernel.
Spoilers in Connect are not readable when I click them. (White on white) Unless I first select the post so the background in grey.