User-space ACE would still be enough to do something like this. All sorts of user-space apps have the relevant permissions and are not secured against attacks t

User-space ACE would still be enough to do something like this. All sorts of user-space apps have the relevant permissions and are not secured against attacks to the necessary extent to stop a state level actor.