kernel modules are a convenience

I would argue that if you are falling to worms or automated attacks that you probably aren't doing anything for security or patching as most automated attacks use low-value, quickly-patched vulnerabilities to spread. IMHO if you have all the basics covered, mangling your OS install isn't going to buy you a whole heck of a lot except for management headaches and you will end up installing those tools (sniffers, etc.) anyway because they are useful.

I would argue that for an APT, no matter how hard you work it won't be enough to keep them out so a strong audit capability to detect unusual activity quickly so you can shut it down and clean it up is a better use of time and resources. Much like how the credit card industry focuses on fraud detection, after transactions have cleared, rather than prevention. Logging and reviewing all sudo logs and other root activity is simple and low overhead and pretty effective.