The attacker will (a) observe or guess the cron process PID,...

The attacker has access to the machine? Yeah game over already, no matter what the program/module does