If you have root access to a host, it's pretty much game over, unless the OS vendor doesn't trust even the owner of the hardware/licensee of the software and has taken effective countermeasures against diving deep into the software (Linux, of course, has not). You don't need "eBPF tricks" to observe processes on the host perform traffic decryption. It's just another mechanism for doing so.

I wouldn't characterize it as "defeating TLS encryption" either, because it's not like you're decrypting traffic someplace other than on the host you already have privileged access to (and assuming you already have MITM capability, which is by no means assured).