Anticheats that run in the NT kernel may as well be described as rootkits, especially as they aren’t transparent about exactly what they’re doing. Then there’s the question of what happens if they get compromised

Vanguard, BattlEye, EasyAntiCheat, Ricochet, etc… all run in the Windows Kernel and most, if not all, have the functionality to run arbitrary code, so might as well class them as rootkits.

If it has kernel level access and can run arbitrary code, that’s a rootkit.

It’s absolutely valid to call these systems rootkits.

Because “rootkit” sounds more ominous and scary than “kernel level anticheat” and the communities complaining about such things aren’t known to keep hyperbole to a minimum. Gotta push that FUD.

This article for instance, using language that insinuates a huge gap in performance between the Linux distros and windows, when it’s a 6% difference between the best and the worst, on one set of hardware.