I think there is a misunderstanding of the two perspectives.

Grandparent's assumption is that the kernel is compromised.

Your assumption is that you can detect malicious behaviour before it happens (and before the kernel is compromised).