If your threat model involves me running somewhere custom code on your machine, but then me not being fast enough to grab argv, you may want to adjust your threat model. Because if I can't under those conditions (even just using shell shit, never mind some really tight c code, or something that hooks into the kernel), someone else can. What a seasoned security person will lean on here is threat models and level of access, but importantly, if I'm already running custom code on your machine as an attacker DO NOT assume I can't get at your argv.