[gruez]

but why does malware need to mess with the bootloader when you can launch DDoS attacks from userspace?

[Kye]

It's a lot easier for something like Windows Defender to untangle something confined to user space than something that can prevent the OS from protecting its files by taking over the boot process.