Without removing the hardware there is no way to prevent someone with remote root access from recording audio from any input regardless of settings. This is true of any machine that has audio inputs and drivers loaded for those devices.
Really, what I see is a software update that fixes a user interface bug. System Preferences no longer offers disconnected audio inputs as a selectable option, because it's just plain smarter that way. Could there any possible confusion for an average user between "Internal Microphone - Built In" and "Line In - Audio Line In" when looking at their sound input options? Seems like a design decision made in the interest of removing irrelevant choices.
The consumer product line continues to have fewer fine-grained controls than Pro products, so nothing has really changed here.
To get technical, you are controlling the gain of the volume of the stage after the microphone. So in the real world the microphone should always show input unless physically disconnected. Computer manufacturers don't follow any standard practices it seems, so you may see it both ways.
So it's not a trivial thing to bypass, but it's not secure. Use a sticker or post-it note if you're paranoid.