On raw hardware, yes, but they're talking about running on a Samsung hypervisor.

Are you familiar with techniques such as mseal? People are trying to take measures to make things in their namespace or address space immutable to protect against partial compromises. It's actually more useful than it seems however it would seem that vendors who are trying to protect selinux this way are not actually able to do it in a robust manner.