I agree with you when you are starting from a blank slate. But in the case of the kernel, there are millions of lines of code out there which depend on the vul

I agree with you when you are starting from a blank slate. But in the case of the kernel, there are millions of lines of code out there which depend on the vulnerability in order to run. While it may be superior to leave the checks on when the system already runs fine with them in place, it's not the same thing as "throwing the switch" when they aren't being used, and just waiting to see where the dust settles.