If the kernel code is vulnerable then the attacker gets full control over your system. They can also easily hide their presence. If the code is in userspace, the attacker won't even be able to read your files if you run the daemon under a separate user account. They only will be able to mine Bitcoins or use your computer as a proxy for a short time.