Even a "local admin to Ring0 without reboot"-exploit might have some uses in malware.
The truth of the matter is that if you are local admin you can already ruin the system in many ways. Once you are admin the game is already over.
Whose fault is it?