Are they really lost though? I think they should not be lost; they could be stored in a separate database additionally.

In fact, as long as the malware is just doing deletes, you can just merge the two "timelines" by restoring the snapshot and then replaying all the edits but ignoring the deletes. Lost deletes really aren't much of a problem!