[thayne]

How would the attacker cause one of these modules to get loaded without already having root?

[staticassertion]

Trivially. Kernel modules autoload through various unprivileged mechanisms.