Windows trusts any signed driver. Attackers abuse that trust to reach the kernel and shut down your antivirus, sometimes with malware Microsoft signed.