Indeed, so probably they'll use signed .deb and signed binaries and if you enable DRM you have to download and install those first.

Which indeed will replace your kernel again, and won't run the backdoors you installed because they're not signed binaries.

Together with capability-based security (such as limiting the browser local access even though able to run JS, Java, Flash, etc) you'll have a good jail.

Ofcourse, part of the DRM is hardware-based. Even though there may be a local exploit in some software, root access has to be gained while execution is difficult because of signed binaries and capability-based security plus, question is what root access exactly implies in such context.

I mean... you're aware the Symbian jails are pretty hard to break, right?