> and unlikely to work on anyone who keeps an eye on their running processes

Rootkits are a thing. It would be perfectly reasonable for a criminal to intentionally use one to hide a process doing illicit things on their own computer from prying eyes.