No, there's no intrinsic reason why you have to modify the on-disk kernel. It just makes detection more difficult, because there's never a point where the OS is

No, there's no intrinsic reason why you have to modify the on-disk kernel. It just makes detection more difficult, because there's never a point where the OS is running without having been compromised. That makes detection much harder. You're right that this is no more secure than using a TPM. But most consumer-grade hardware has no TPM, and hardware vendors aren't going to add one just for Microsoft.