[besselheim]

That doesn't help you if the code running outside your filesystem is compromised.

For example, a backdoor implanted in the disk firmware would be virtually undetectable for the vast majority of users.