I agree. Malware has been known to install vulnerable signed drivers to get unsigned kernelmode code execution.