> Anyone can do that, but not anyone can simply “patch the kernel” and such.

Sure they can - download this pre-patched ISO and boot it in QEMU. Now you have a modified kernel, _and_ you’re not running dodgy spyware on your PC.