Readers here are all very likely to appreciate some links alongside statements, cause really this is a sensitive topic. Both statements need certain context as it seems it’s not the universal understanding of what goes on and how often.
SetWindowsHookEx is a blast.
Not sure it can be proven with citations but it's well known that process injection is widely used on Windows. GPU drivers are known to do it. Utilities have historically often injected code into Explorer. Raymond Chen has written in the past about this problem and how hard it made it to evolve the platform.