ok, but what kind of nefarious use case will it enable if it is accessible to malfeasance.

I may be wrong, but on a correctly-configured system, one would have to have root access to act nefariously. Since this is intended to prevent exploitation of vulnerabilities that enable privilege escalation, it feels like a net win.

I guess it could disable the killswitch