Since this exploits user level privileges, perhaps a good idea would be to have a privileged version control system for user data. In that, you need admin/root access to actually DELETE anything, and any file system changes by users are simply versioned away. This means if you had ransomware that fucked up your files (since this software typically runs at user level), you could just instruct said versioning system to roll everything back as an admin?