I guess one point of the article is that eBPF-injected programs are another place where malware can hide. But then again, it's easy to list all currently loaded eBPF programs (well, unless there's a way to somehow hide/disconnect them, but keep them running).