Except that any process that has obtained root (through a security flaw or otherwise) can extremely easily hide itself, as shown here.

I will admit that it's likely that the same thing could be done with loadable kernel modules, that said.