Since it's capability based, the kernel doesn't export a list of current processes. That arguably makes rootkits easier even if they live in user space.