If it has to go through another layer , hopefully without ring0 privs, which more than likely may filter out a number of exploit vectors, how is this the wrong approach ?

Breaking this layer doesn;t automatically give ring0 privs across the hardware.