The user account can simply become root by typing sudo gainroot, so I don't think that it is a big security hole The intruder can see your files in user and root accounts.