Typically they are used to remove security software (EDR like CrowdStrike or antivirus) that would stop you deploying your ransomware.

Normally security monitoring tools have mechanisms to stop even and admin uninstalling them without a software specific password, a vulnerable kernel driver would allow you to bypass that.