These exports have the power to change the implementations of all
syscalls and I've seen people exploiting this "feature".

Make the exports GPLonly (which some LSM folks agreed to
when it was merged initially to avoid that).