I think you may be missing tptacek's point. Things like code signing make it harder for bad things to run without the user's permission.
Obviously this is hypothetical but given the trend toward national surveillance is it hard to imagine that this can happen?