Theoretically, Microsoft could protect against most attacks. Apple has done it by making it increasingly impossible to touch kernel level stuff without an MDM. Every release they lock up more of the system. It means they are drifting toward iOS on their Macs, where the user doesn't own their device, but it is an effective blocker to stuff like this, baring zero day kernel issues.
I think that is where Microsoft is headed, but they also aren't able to let go of backward compatibility, so they really aren't getting any closer to a system that is secured enough to handle such sensitive data.