ChromeOS' root filesystem is read-only with tamper-proof authentication. And notably, there is no way to autostart anything.

So in the worst case where an attacker gains code execution in the kernel, you just reboot the device and are guaranteed to be safe again.