Comment by Cockbrand

I thought the same. Wouldn't it be trivial to just replace 'whoami' or 'sudo' with a script that silently fires some kind of alarm and still gives the expected output? Or am I missing something here?