> What stops the attacker from just editing /etc/rc.securelevel and then doing a normal reboot?

Certainly a full reboot leaves more tracks than no full reboot? So it's harder to hide?