And this is a good reason to lock sudo down to a single application that is allowed to be run. In my case I only allow su for my user. Now even if an attacker were to try and use sudo they would also have to know that they can only use su, and most automated attacks will fail.