If you have already been pwned, the OS is compromised so it clearly is not able to retroactively undo that - any checkbox, option or whatever can just be turned

If you have already been pwned, the OS is compromised so it clearly is not able to retroactively undo that - any checkbox, option or whatever can just be turned into a no op that lies.