What happens when a security bug in a signed Windows or driver version allows accessing the hardware? Once such a version is found could it not be used for all the same things as a Linux kernel that intentionally allows loading any module? Is there some efficient blacklisting or other mechanism to recover from this?