>So off to google which leads me to more ways to hard disable Defender, and it worked confirming Defender was used as a screen by Microsoft for a more nefarious process

Why immediately jump to "screen by Microsoft for a more nefarious process"? It sounds like you were sloppy with your initial disabling (or more charitably, microsoft dark patterns), so you actually disabled "real time protection" or whatever, rather than everything.