On arm64e the hardware signs the pointers worth hijacking and checks them on use. The key is out of reach of any memory write, so attacks work around it.