Why are daemonless builders like Kaniko or Buildah attractive for CI specifically?

They build OCI images without requiring a privileged Docker daemon or socket access at all, which is significantly safer in shared/multi-tenant CI environments (like Kubernetes-based CI runners) where granting any job privileged or daemon-level access is a major security concern.