Back in the NT days malware could totally intercept it, but it would have had to be in the kernel. Which was something of an improvement.
Thank you, DoD Orange Book.