I bet something like this (plus Vasiliy's changes to static module
aliases) would cover 99.9% of legitimate uses of this feature:

diff --git a/net/core/dev.c b/net/core/dev.c
index 54aaca6..0d09baa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c

@@ -1120,8 +1120,20 @@ void dev_load(struct net *net, const char *name)

       dev = dev_get_by_name_rcu(net, name);
       rcu_read_unlock();

-       if (!dev && capable(CAP_NET_ADMIN))
-               request_module("%s", name);
+       if (!dev && capable(CAP_NET_ADMIN)) {
+               /* Check whether the name looks like one that a net
+                * driver will generate initially.  If not, require a
+                * module alias with a suitable prefix, so that this
+                * can't be used to load arbitrary modules.
+                */
+               if ((strncmp(name, "eth", 3) == 0 &&
+                    isdigit((unsigned char)name[3])) ||
+                   (strncmp(name, "wlan", 4) == 0 &&
+                    isdigit((unsigned char)name[4])))
+                       request_module("%s", name);
+               else
+                       request_module("netdev-%s", name);
+       }
 }
 EXPORT_SYMBOL(dev_load);