Why does the neuvector-scanner run as a deployment rather than a daemonset?

[cncal]

As scanner's README says:

The scanner runs with the NeuVector controller to provide registry scan and runtime scan functions.

May I assume that just one scanner running on each node is sufficient? If so, the scanner deployment with default 3 replicas will be bad practice as it's not guaranteed to be evenly distributed among nodes and what do we do when the number of nodes is greater than 3? Yes, Changing the default number of replicas is one way, but I think daemonset would be a better choice.