Author here. My hosts file was written to without notice. The Adobe Creative Cloud app runs as admin, and does automated updates (when it's working as intended) without further requiring a password. Most of the things that I listed as deleting in my post required me to enter an admin password to delete. However, the Adobe updater happily updated them without requiring a password. One of them was a background helper in `/Library/PrivilegedHelperTools`, which is granted root access on installation. It runs as root on boot, and can do basically whatever it wants. I don't know how this works on Windows, but I assume it's something similar.

The only reason I knew that it was happening was because of a Hacker News post (https://news.ycombinator.com/item?id=47664205). I linked to the same OSNews article linked to in the HN post in my piece. It seems like Adobe has reverted this change since then because of the pushback (and insanity) of this sort of change. But there's nothing surprising about the mechanism here. The only unbelievable bit is that they'd choose to do this.