Why bother loading a module when you can inject code into any function you want.

Unfortunately, threat actors tend to have a stash of them and the initial entry vector often involves one (container or browser sandbox escape), and once you have that, you are in ring 0 already and one flipped bit away from loading the module.

The Linux kernel is not really an effective privilege boundary.

This doesn't solve all vectors but afaics this will prevent non signed modules from loading.