No, it’s not NTFS, it’s the file system filter architecture of the NT kernel.

I had internalised that it was Windows Defender hooking every file operation and checking it against a blacklist? I've had it forced off for years.