No reason they can't do both, it increases security. Security is all about layers. You fight malware where you can. You should never depend on any one defense, however strong it is.

>I think parent was wondering whether Microsoft should be more concerned with why their system allowed the rootkit to install itself in the first place

Short of iOS style lockdown, how do they do that? Even OS X and Linux can be rootkitted.