Quoting the Mozilla engineer responsible for most of the recent activity on the bug:

"This problem has two sides: Microsoft was doing a lot of useless computations upon each event; and we are generating a lot of events. The combination is explosive. Now that Microsoft has done their part of the job, we need to reduce our dependency to VirtualProtect."

It was also noted elsewhere in the thread that similar, though less severe, CPU impact is seen with other antivirus products.

Microsoft was doing something wrong that made this operation more expensive than it needed to be, but Mozilla is also doing this far more than any other browser.

One could also argue that the OS is the car, the browser is the chauffeur, and the user is the passenger.