Someone remarked upthread about Artem's very excellent Trail post, which you can sum up as "attackers can create conditions where eBPF events might not be generated, or where eBPF probes won't be able to see the requisite data". In a pure logging monitoring situation, those problems aren't that big of a deal (the things you'd have to do to force those conditions will be noisier than the events you'd be trying to generate, and, more importantly, the things you'd do instead of eBPF to do that kind of monitoring have their own gruesome limitations).
But as soon as you add a "drop" response to events, you've switched from a monitoring tool to a reference monitor; at that point, this stuff has to work.
But as soon as you add a "drop" response to events, you've switched from a monitoring tool to a reference monitor; at that point, this stuff has to work.