I guess an alert is better than nothing. But you still have to deal with the cleanup. It seems the only real way (which I figured out) is to have a separate management system from the CMS.

Having the CMS manage it's own files seems like an oversight committee watching itself. :P

This seems like an opportunity for WP to do what Microsoft did, make their own security system to pair up with WP.