Could snapshots via tmutil be used to protect against this kind of thing on MacOS?

https://derflounder.wordpress.com/2019/05/08/creating-managi...