Could eBPF Save Us from CrowdStrike-Style Disasters?

I thought that Falcon running in "user-mode" under Linux already uses eBPF?

Not if there's a lower bidder.