> and unlikely to work on anyone who keeps an eye on their running processes

Rootkits are a thing. It would be perfectly reasonable for a criminal to intentionally use one to hide a process doing illicit things on their own computer from prying eyes.

On the other hand, people with that kind of evil inside of them don't go around letting everyone know. They keep it secret and hide it well. Most of the time. So it's not entirely surprising that when that happens to someone you never would have expected it.