Userspace is really not the issue here at all. The problem is that the device was given full access permissions to every role on the system, when it should have been (trivially) limited to only system services. All of Android is userspace and relies on the kernel's userspace protection system (standard unix permissions) for security.

It's just a major mistake on Samsung's side that could have been avoided with 5 seconds of thought by the engineer.