> With a security-strengthened operating system, or with a VM/container/sandbox, it is possible to ensure that any opaque user-space program is no security risk.

This is absolutely not true.

It is possible to restrict an opaque user-space program to the minimal set of permissions it requires.

In this particular case, the program needs to manipulate system hardware in undocumented ways, via vendor code which is extending the kernel.