> The whole point is that if malware gets root access Strictly true, in that if it does get root access, and is aware of zfs snapshots and deletes them, then y

> The whole point is that if malware gets root access Strictly true, in that if it does get root access, and is aware of zfs snapshots and deletes them, then yes. Nothing you can do. More typically, the malware runs as the user id and has no awareness of zfs, so it just overwrites files the user owns. Which can be trivially undone with snapshots. As with everything related to security there is no absolute, but every layer helps.