A bytecode VM loader sounds fancier than a template-based shellcode loader, but the talk keeps landing on the same annoying boundary. Randomized opcodes and an interpreter may bother static analysis, while the Win32 calls, call stack, memory permissions, and behavior sequence still give EDR something real to watch.