The researcher use a kext afaict solely to provide an exploitable gadget - e.g an attacker would need to find one themselves, and finding a kernel bug is not so

The researcher use a kext afaict solely to provide an exploitable gadget - e.g an attacker would need to find one themselves, and finding a kernel bug is not something that gets a journal publication so isn’t relevant to the research. In that case using a kext seems reasonable. The attack itself however seems like it’s fairly close to requiring true arbitrary code execution (the earlier spec. Execution bugs could be unit from “correct” JS).