The malware would have to prompt for biometric authentication before exporting.