The device is tampered with, and all attempts at tampering must render it unusable.
Right now, we will focus on the first threat model. It is very difficult to build a tamper-proof system, and you need to worry about tamper-proofing your hardware, depending on what kind of actor is a realistic threat.
Does the /bin/sh executable downloaded from the NetBSD FTP server contain any sensitive information?
On a BSD system, due to the separation of the base system and packages, many root file system directories are mostly unmodified outside of upgrades. In a properly configured system, nearly all system daemons and user applications are not going to be running as root, so won’t have permission to modify or create files in /bin.
