The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in the forest of legit "systemd-*" files.

The kernel any OS including linux runs is not source only at all, it's compiled, maybe by the user from source or by a redistributor which then passes it in compiled form to your system.

Furthermore this malware seem to not mess with the kernel, but pretend to be a normal system service.

ELF means Executable and Linkable Format, it's the executable format which Linux binaries use (and not just them). E.g. a shared library (Linux version of DLL) is in elf format. A variation of ELF is also used by UEFI but that doesn't seem to matter in this article.

So basically someone or something hacked their system and installed this malware or they where tricked into installing it themself.

The fact that the involved files where named in ways which totally could be normal parts of the system didn't help (but is also common, so I wouldn't say it made it harder).