They used the initial admin access (via the 'fake' password prompt) to install a tool that has setuid 0. Setuid 0 means that whoever executes the tool, it alwa

They used the initial admin access (via the 'fake' password prompt) to install a tool that has setuid 0. Setuid 0 means that whoever executes the tool, it always runs as user 0 (aka root). That is what enables them to continuously re-add their bullshit into accessibility settings. So they aren't storing a password, they're installing a program that has permanent unlimited (barring System Integrity Protection on newer versions) access.