Since then, with some tips from @Jarda, I also have extra hash checks to see if any of the crucial package files have been changed. If so, plugin is fully deleted and replaced with static HTML file, informing about the situation
But that’s a bit of topic, so better to continue on one of the existing or create a new one about protection
