It doesn't capture every keystroke in the system, those sent to an elevated window are not sent to the low-level hook: https://stackoverflow.com/q/52696285
This fits with the security model of Windows, and PCs in general. Processes from the same user can see and interact with each other, but not with those of another user. Users are expected not to run any process from shady vendors.
This might seem lightweight security in the age of too much internet where everyone runs anything, but it is what enables some kind of openness and control on those platforms, vs. the very controlled interfaces of smartphones.
This fits with the security model of Windows, and PCs in general. Processes from the same user can see and interact with each other, but not with those of another user. Users are expected not to run any process from shady vendors.
This might seem lightweight security in the age of too much internet where everyone runs anything, but it is what enables some kind of openness and control on those platforms, vs. the very controlled interfaces of smartphones.