You don't even need a bad actor, the drive will do that on its own. Malicious firmware only needs to be invoked if the attacker wants to be SURE that the preserved data 'just happened' to cover e.g. your crypto keys.