also, there's nothing preventing a program from debugging a trusted process, and getting that process to perform the requests for the malicious program.