I guess one point of the article is that eBPF-injected programs are another place where malware can hide. But then again, it's easy to list all currently loaded eBPF programs (well, unless there's a way to somehow hide/disconnect them, but keep them running).

not a ebpf expert, just been on my radar lately because i’m going through a sysdig poc.

To me It feels more like a reverse proxy for intercepting traffic going between user land and kernel space.

As we move to k8s and classic EDR isn’t feasible i 100% understand the need. It still feels like a dumb thing humanity has done and will blow up in our face after having the kernel / user space security boundary beat into our heads for so long.

Do you mean having malware code already running in kernel space, or having system permissions to install new kernels?

For the latter case, there are now mechanisms that aim to prevent root from modifying the kernel or otherwise getting ring 0 access, see eg https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7....

But even in a non locked down mode, there are practical advantages for the adversary in using officially supported interfaces vs their own kernel module or leveraging some i/o path to access kernel memory.

No, you're reading it right.