Earlier quoted context omitted.
Or a testament to how little the industry actually cares about security once you ask them to actually put their money on the line. Windows Defender was new in windows 10; there is no conceivable justification for using the kind of programming language that leads to this kind of vulnerability. But, here we are.
Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceivable justification for using C++? Really? None? The entire language is unsuitable for new development? And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? What do you suggest we do? Gather the whole wo…
Many people in microsoft seem to be thoroughly stuck in the microsoft way of doing things even when not ideal. How many COM objects did they for years after COM was dead? For how long did they ignore the concept of an AST during parsing of C++? Even in msvc2015 rev 3 you can't reliably turn this feature on for even a moderately sized codebase, but it is the default for GCC and Clang and has been for years. There might be a lot of smart people as microsoft, but they are often isolated from cutting edge ideas or squashed by bureaucracy.
I even really like C++, but perhaps for a security product that isn't particularly performance sensitive something else would have been better. It doesn't seem to run all the time like other AV products and just at the boundaries where information can get in and out this means it does a lot less work and has looser performance constraints, perhaps they could have used C# another in house languages.