It's not always as easy as you imply. All the attack vectors you mentioned, require root on the host, before you can make the change or install the trojan.