I guess they just see every extra interface between kernel and userland as another attack surface and therefore to be avoided.