Windows Defender flags all crypto miners. It is not unique to NiceHash. You don't have to add an exception for the whole NiceHash directory for it to work, but it makes it easier. NiceHash updates the miners occasionally, and if you don't add an exception for the whole directory, then every time a miner gets an update, it's disabled by Windows Defender until you manually allow it.
Seems like there should be a way to have NiceHash sign their binaries or otherwise vet with Microsoft so Defender can automatically allow it. Setting an exception seems like it makes it a target for other malware to hijack or piggyback on.
Cryptominers fall into the "Potentially Unwanted Program" category, along with remote access software like a VNC server. They're not malware, but can be installed maliciously. If Windows Defender finds a cryptominer, it has no way to determine if it was deliberately installed, so it flags. Manually excepting the directory NiceHash installs the miners is the only way around it.
