You might not have high privileges on the system you're targeting. If you don't have ring 0 or equivalent privileges that allows you to modify the kernel (e.g. by loading custom unsigned kernel modules when supported), you might have to limit yourself to a userspace rootkit. Just because you have root doesn't mean you can get ring 0, and many secure configurations prevent root from modifying the kernel.
Another reason you might prefer a userspace rootkit is because it is less likely to crash or malfunction. A kernel rootkit will typically only work with one specific kernel version, and any update to the kernel requires adjusting the rootkit. Furthermore, a kernel rootkit is more likely to cause instability and bring the entire system down. If you don't need the powerful features a kernel rootkit can give you like syscall hooking, you might choose the option which is more stable and works on a wider variety of systems.
A well-designed userspace rootkit might work equally well on Debian Linux as on Solaris (a UNIX which has no code in common with Linux systems), but a kernel rootkit designed for Debian with kernel 4.18.6 might not even load if you try to run on CentOS, even if the kernel version is the exact same.