When most of this code was written, sandboxes didn't exist. Existing security concepts were built around protecting users from hacking each other on a shared multi-user system. Of course a user is allowed to patch their own processes, how else are they going to debug them and why should we stop them from doing so?
The fact this is possible is the clowniest thing! Why would a major system component allow "extensions" to run without a sandbox and modify its code?