I'd argue that the decision to keep it in userspace was the right one. If an application doesn't get security updates, a broken QUIC stack is probably the least

I'd argue that the decision to keep it in userspace was the right one. If an application doesn't get security updates, a broken QUIC stack is probably the least of your worries. You also mention Android, which is notorious for having a lot of devices that don't get OS updates because they've reached end-of-life. Protocol ossification at the OS level is also a valid concern. https://http3-explained.haxx.se/en/quic/quic-userspace https://http3-explained.haxx.se/en/quic/quic-userspace