I don't understand the point you're trying to make. That because one exploit exists, and using that exploit is cheap, the entire class of attacks is cheap?

Sorry, but this entire thread is nonsense, and it's just a clear demonstration of a lack of threat modeling and frankly a lack of understanding of what attacker capabilities are.

The basic principle of real security models is once an attacker has full access all data on the system is potentially tampered with.

You can try to play games with ensuring logs leave the system, but everyone takes shortcuts to make sure they can recover the system when networking is down etc.

Everyone and their grandma has access to complex scripts, etc that were once very expensive. Whether they invest the energy in learning methods to hide their presence or just go straight to some other goal is going to depend on how they intend to abuse your systems.

I think most "security professionals" pretend they are going to catch an oddity that occurs that doesn't match what their automated tools would catch and occurs in the middle of some other crisis or holiday break. I would say good luck with that.

> The basic principle of real security models is once an attacker has full access all data on the system is potentially tampered with.

That's not true at all. Like, not at all.