Great that it can't be removed, but can it be used by the malware on the system to perform the task on behalf of the user? In the days of always connected computers just remotely controlling the SW on the HW itself is enough to do pretty much all the interesting things you could do (as a criminal) if you were in physical possession of the computer itself.