code running in kernel space is hugely privileged… it can open up enormous security vulnerabilities because when you’re in the kernel you can bypass a LOT of security checks and restrictions… windows code is generally pretty well tested, so is unlikely to have particularly bad bugs like RCEs etc… but these kernel mode apps aren’t nearly as rigorously tested - things like this is what lead to the crowdstrike outage

things running in the kernel can also cause a lot more damage than user space apps, because the kernel doesn’t do a lot of the error checking and validation that stops things like kernel panics