On: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

[flipped]

>persistence I guess no point in having any

The most obvious reason would be the fear of patching a vulnerability which the attacker used to gain initial access. Persistence is required.