[sintax]

Don't know about apple, but on linux you can live patch a running kernel with security updates (kpatch/ksplice/...).

[saagarjha]

Right, which means that an attacker can trick your kernel into patching itself to do something malicious.

[dizhn]

And automatic periodical reboots give hackers the piece they were missing. :)