Private Memory for KVM Guests

How does this actually offer any security? Couldn't a rogue hypervisor admin just deploy a custom kernel where MFD_INACCESSIBLE is a no-op?