Is that still true if the attacker has access to system memory? That's a more difficult attack but still feasible for a malicious VPS admin.