They delegate to a userland process for most things and apparently have had multiple audits on this driver, according to what they've said about the same thing that they run in their game Valorant.
It's worth noting that golang builds can be smaller than that with `GOOS=linux go build -ldflags="-s -w" .` (assuming a build on macos for linux.) From there I usually run `upx --ultra-brute -9 program` before dropping it into a `scratch` docker container (plus whatever other deps it needs).