It's debatable. Once the user has installed unauthorized software, the attacker can simply sit and wait for the user to expose more goodies (logins, bank data,

It's debatable. Once the user has installed unauthorized software, the attacker can simply sit and wait for the user to expose more goodies (logins, bank data, 1password access, etc). In many ways, it is game over. If the attacker can leverage that to get your admin password, prompts are not going to save you.