So, how is 'secure but with LKMs enabled' at all different (from a
   security perspective) from 'insecure'?

they are not.  this is why i made jason(?) fix this a couple of
years back, when i discovered that LKM's (then) totally defeated
the concept of `kernel security'.