As detailed here on this Microsoft KB page:
[...]By default, the system account is granted full control to all files on
an NTFS volume. Here the system account has the same functional
privileges as the administrator account.
Windows Defender's antimalware service runs under this SYSTEM user, essentially giving the service access to everything, including all other processes, whether they are running with administrative privileges or not.
If you still need to make sure what Windows Defender is scanning in real-time, I posted an answer to a Super User question here that tells you how to use Process Hacker to see what files are being read by the service.
Process Hacker can be used to
view the files that are being scanned as well. Once installed, run the
program as an Administrator, or click
Show details for all processes
in the Hacker dropdown menu.
From there, go to the Disk tab. All files that are being read or
written to will be displayed; any file in that list that says it is
being read by MsMpEng.exe (Defender's main executable) is being
scanned. It's easier to see what is being scanned if you paste
MsMpEng.exe into the search bar at the top right of the window and
then click the File column to sort alphabetically, as this filters the
list so that only the files being scanned by Defender appear.