Amid my gaggle of computing devices, I have a couple of Win10 computers, and I use them fairly regularly (right now, for example). One thing that annoys and amuses me in almost equal measure is the behavior of Windows Defender in labeling software of which I approve as “potentially unwanted software” and modifications I make to system elements (like the hosts file) as “dangerous,” when all those programs and mods do is limit Me$$y$oft’s privacy intrusions, tracking, etc.
I do go ahead and rescan those “dangerous” (to Me$$y$oft’s nefarious intentions) applications labeled as “PUPs” with trusted third party antimalware even though I scanned them with multiple trusted third party antimalware applications before I installed them, and invariably the third party software calls ’em good (because the only “malicious” behavior they have is limiting bad behavior by Me$$y$oft, of course).
So, far, the rule is invariable: safe, effective blocking of Me$$y$oft spyware is gonna be labeled as malware by Me$$y$oft. Of course.