That appears to just be for virtualization. That is not quite the same as using it to protect the kernel from malfunctioning devices because only devices that are being passed through to a guest have any kind of restrictions. Please correct me if I am wrong.