This is not the Win32 API, and Raymond Chen and others at Microsoft very much did draw a line when it came to people using the Native API of Windows NT.
Some third party software like antivirus (and kernel mode drivers?) does use the native API, so they probably want to avoid gratuitously breaking things even at the NTDLL level (although as this table shows, making raw syscalls is something they'll break).
Drivers are a very different kettle of fish, and don't really involve NTDLL.DLL at all. They don't have to involve a full syscall transition, for starters, and there is a whole flavour of the Native API that doesn't. (I'm glossing over the details a bit. Go and read about Zw versus Nt in any good device driver book.)
Stability of the Native API per se isn't really a big concern for drivers, not least because Microsoft invented other APIs for drivers, such as the one for graphics drivers that made drivers so loosely coupled to other things that it let the entire graphics subsystem be moved into the kernel in Windows NT 4.
And the reliance of antivirus softwares on the Native API, and thus the need for stability, is somewhat overblown, not least because the Native API is far too high level a layer for antivirus softwares to trust. The flashy GUI bits might as well be just written in ordinary Win32 et al., and the other bits are busy being … well … essentially rootkits. (-:
