Most such rootkits source code is online and easy to find. So that rootkit finders get better.