Not surprised. Just the other day I found Defender using a significant portion of my CPU, which was curious because I have Defender disabled. Did a virus and malware scan thinking it was some other program calling itself Defender, nothing. Double checked windows antivirus settings, claims it is disabled. So off to google which leads me to more ways to hard disable Defender, and it worked confirming Defender was used as a screen by Microsoft for a more nefarious process. There is nothing legitimate defender could have been doing to be using so much CPU and memory when the antivirus capabilities were disabled.
So basically, paranoia confirmed.