Final Word was Mac Security: OSX.Exploit.MetaData.B Trojan 3260

Which is enough, if root is enabled and has no pbuttword or has a weak pbuttword.

Do you think malware authors are going to feel duty-bound to comply? ;-)

buttuming the malware author has written a man page, and buttuming that the "administrator" (John Q. Publique) has a clue about this stuff.

"Can" being the operative word.

Plain but not very comprehensible to the average user.

Which most users have no knowledge about finding out what privileges are, where to find them or how to modify them. ls -al and chmod are not part of most Mac users' vocabularies. Even changing permissions via Get Info is unknown to most users.

Even if they haven't a clue what receipts are or why they can be useful?

But not necessarily stopped or disabled.

Sounds like an exploitable security risk. A script could search user names, keylog pbuttwords and execute an installation, potentially resulting in an entire network having an automated installation of malware.

"Competent" being the operative word here. I've used Macs exclusively since 1986 and OS X since 10.0.3 but I couldn't write such a script. By implication I am not competent, which I won't argue against, and neither are the vast majority of Mac users. We're the people that OS X malware authors will exploit.