NinjaOne remote desktop

Many RMM products do that - Kaseya, ConnectWise, NinjaOne, etc.- adopt a similar architecture because it is a proven pattern for them: a single Windows service with full privileges that can handle everything from remote command execution to patching. Windows service architecture differs significantly from Linux, and RMM tools often consolidate broad functionality into a single service for simplicity. On Linux, daemons commonly drop privileges after binding to a port, or they run as unprivileged users. On Windows, that style of privilege separation is less common because of the way the SCM (Service Control Manager) and local accounts (Local Service, Network Service, etc.) handle privileges. While it is possible to run a service as NetworkService or LocalService, certain advanced tasks (like enumerating every process, installing drivers, or performing all system-level patch operations) usually require additional privileges that aren’t easily granted to those service accounts. Basically RMM agents like that for core functionality do it for system wide control, if the agent is compromised the system is already pretty much fucked do to the intended functionality it is capable of so its one of those rare apps like AV where it doesn't make a lot of sense to limit it like that.