I'm not sure you get it. This is hardware overlay. It's not running in user-space, it's being moved from memory to graphic card directly. A DirectX drawn window is not affected by focus or anything else. You can stop it by killing the process.

If someone came ahead of time to prevent it from ever gaining screen access, then that would be a problem, but since the order of app launches are known and can be controlled, it would still work.