Comment by saagarjha

They load a kernel driver so your avoidance of LD_PRELOAD wouldn’t really be able to protect against this anyway.