There is no such thing as a runtime environment that (a) attackers gained RCE into, and (b) the box with the sensitive data can verify the incoming connection i

There is no such thing as a runtime environment that (a) attackers gained RCE into, and (b) the box with the sensitive data can verify the incoming connection is from an audited, signed binary. Simply put: if you have RCE into an app, then that breaks all the guarantees of that audited, signed binary. You can make it sing and dance and ask for a thousand rows instead of ten; you can do whatever you want to it. The modifications happen in memory, not on disk, so even if they don't persist you can still modify the app. Monitoring seems like the only solution.