This is also a good reminder why running services as root is not recommended. If he had used a separate non-root account for Redis, the damage would have been limited to that single user account. That's not a very good situation either, but at least the attacker would not have been able to modify init scripts and replace system files.