[garg]

A good defense against this would be to have all the local HDs encrypted. That way nothing can run/access the contents of the HDs without the encryption password.