But the files do not need to change frequently, unless you want to upgrade the system. Modules is easily used to intercept the kernel. Module is a good design for the linux kernel to make the linux kernel more modulized and more felixible. But after the modules inserted into the kernel, it will be part of the kernel and can do what the original kernel can do. Therefore some unfriendly code could be written as a modules and inserted into to kernel, the code can even redirect the system call and act like a virus.
Process is unprotected.
Certain processes, such as web server daemon, which are critical to to system is not under strict protection. Therefore, there are vulnerable to the attack of hackers. This is what LIDS do. The Linux Intrusion Detection System is a patch which enhances the kernel's security . It uses and extends the system capabilities bounding set to control the whole system and adds some network and filesystem security features in kernel to enhance the security.