Running your malicious actions without writing to disk is a very effective way of bypassing a lot of security and forensics technologies.

As soon as you make changes have persistence you have proof and some operators are not oaky with that.