I suppose a malicious program with elevated admin privileges can Disable UWF (it can't be disabled without admin) - but it wouldn't apply immediately - only at

I suppose a malicious program with elevated admin privileges can Disable UWF (it can't be disabled without admin) - but it wouldn't apply immediately - only at the next boot. And at this point (next boot), the drive would still go back to the "clean" state again so the malicious program would presumably be gone and couldn't do more harm. Albeit in this scenario, UWF is now disabled, so future writes go directly to the disk until UWF is enabled again.