The niceness of the Hurd design, conceptually, is that the microkernel orchestrates system integrity, while even an unprivileged user has a lot of freedom as to what to run on top of that. They can launch drivers, file systems, run sandboxed kernels, and so forth.