...But what if you can implant into the kernel? Also, what if you don't want to use a full-featured zero-day kernel exploit if you can get your target with a somewhat lower tech exploit?

Clever to just recover all your data using a browser process which has (likely) already been fully authorized to exfiltrate data.