Once a malicious attacker gets a foothold on a system, they will typically attempt some kind of privesc vector in order to gain root access. Once this is achieved, the typical next step is to install a rootkit: essentially, a collection of scripts and kernel modules that will pretty much take over the system (by "hijacking" system calls, setting up backdoors and keyloggers, and so on).
Of course, it's not easy – the security posture of a modern production quality Linux system, replete with Linux Security Modules (LSMs), and so on, means it's not at all a trivial thing to do, but for a skilled and motivated attacker, anything's possible. Assuming they have a sufficiently sophisticated rootkit installed, the system is now considered compromised.
An interesting idea is this: even with root access, do not allow insmod(8) (or modprobe(8), or even the underlying [f]init_module(2) system...
