``But sperg-kun, cannot they simply kill the process?'', you suggest a perfectly reasonable work-around.
That is not an option since Linux users, being the technocucks they are, do not have local admin rights on their own machine. This means that when someone takes control over their machine, they may steal personal and financial info, but at least they will not be able to update Gimp.