The latter. There's no obvious reason it would decrease security, but if the main kernel is compromised, the inner kernel's security model is really hard to enforce correctly against an opponent which is also running in ring 0.