RPKI doesn't sign hops in the path for a BGP update. That means to hijack a prefix, all you need to do is to take a legitimate route and re-advertise it with your AS as the second hop in the path.

This isn't as damaging as being able to advertise a smaller prefix because it won't send all traffic to you. It will just send from routers where your path is shorter than the original.

To actually prevent hijacking via path shortening attacks like this, you need a full BGPSEC implementation https://en.wikipedia.org/wiki/BGPsec which is a much higher barrier than RPKI because the crypto operations jump 1 or 2 orders of magnitude (signing every re-advertised route rather than just originated routes).

So RPKI gets the cert infra in place, but it doesn't really fully solve the problem.