Nothing here prevents you from doing this in a VM. The problem with being able to tinker at will with a consumer system is that you have no way of choosing who

Nothing here prevents you from doing this in a VM. The problem with being able to tinker at will with a consumer system is that you have no way of choosing who is tinkering with your system. If as a vendor you take the security and privacy of your customers' information seriously, you cannot deliver an "open" and "tinkerable" system. The two are fundamentally at odds. This has been sufficiently obvious for long enough now that anyone still complaining about how they can't run their own kernel on their desktop is almost certainly a surveillance-state troll.