sounds good
not sure if something like SuperUser control app is impossible, probably Inception would be a good place to do this. Lets say, Inception could install itself, close the 'vulnerability' and from that point take control on access to su.