[youareawesome]

Loading BPF requires root, so does loading kernel modules. I.e. if you have permissions to load BPF, you can already load arbitrary code.

[monocasa]

At the moment.