Right, I kept using "wheel" to mantain the terminology in the github page, but clearly this created confusion. But my point was that, regardless of whether you

Right, I kept using "wheel" to mantain the terminology in the github page, but clearly this created confusion. But my point was that, regardless of whether you use sudo or su, on GNU/Linux or on *BSD, if the account used to elevate priviledges is compromised, the next you elevate you priviledges you should expect the attacker to follow you. This is what I meant by "the attacker is root as well": it's just a matter of waiting for the next time you use su or sudo.