What Uses ThreadHideFromDebugger/Thread_create_flags_hide_from_debugger?

Windows supports calling NtSetInformationThread with ThreadHideFromDebugger as an argument, and calling NtCreateThreadEx with THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER as an argument. Doing either of those things will, as the name suggests, hide that thread from the debugger. Obviously, these are incredibly useful for malware authors to inhibit reverse engineering by security researchers. Is there any legitimate use for these during actual debugging, though? If so, what are they? If not, why would Microsoft give Windows a feature only useful to malware?