> It also commonly referred to such kits being used by hostile parties.

I suspect that's exactly what he means - a rootkit is deployed by an intruder so that when the admin discovers the host has been compromised and patches the vulnerability, the rootkit, if not addressed, will grant the intruder root capabilities once more.