If the attacker was able to backdoor the system, isn't also possible they could install a modified shell that no-ops \?