Because to get Ring0, you just need signed vulnerable driver.

There are tons of signed drivers to explore ;-)