Comment by flipped

>persistence I guess no point in having any

The most obvious reason would be the fear of patching a vulnerability which the attacker used to gain initial access. Persistence is required.