So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to s

So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?