But if an attacker can put arbitrary code into your .bashrc, you are already executing arbitrary malicious code.

Same if an attacker can run arbitrary docker commands.