> malware loading after the operating system kernel could be contained by the normal security mechanisms like ACLs

If this were true, how would the malware ever get itself to the point where it is loaded before the kernel is?