If I understood correctly, using the root permission granted by the user when the prompt for the password comes up, they hack the database containing the accessibility settings, and add themselves to the list.