The vanguard drivers are signed by Microsoft, the procedure for which includes a safety audit by Microsoft.

The driver is just what the developers say it is (as with all other anti-cheat). It provides an untempered interface for the userland anti-cheat to use to get info from the kernel. Because modern cheats tend to alter the output of kernel syscalls by running in the kernel themselves.

I really don't see why anyone needs to think it's anything more than that.

If Tencent needed to spy on you so badly there's no reason kernel anti-cheats need anything to do with it...