Security products of this nature need to be tight with the kernel in order to actually be effective (and prevent actual rootkits).

That said, the old mantra of “with great power” comes to mind…