Seems really iffy that code can't/wasn't staged; pretty standard in the industry, for decades now. "Bleeding edge," is not something any enterprise should ever dip their toes in when it's at the OS-impacting level.
IMHO: is the fundamental FAILURE of "any code can over write any code" that OS vendors fail to properly address.
Simply detecting a change after the event is often times to late.