Unix systems almost always require root privileges to mount unmounted partitions. I'm sure Apple has modified this process to be able to mount USB devices without it, but I would be very surprised if they allowed mounting the recovery partition without having to sudo. This means that malware would need root access to mount it, or would need to guess your admin password.
BSD systems and their deriviatives also include a securelevel feature, which includes a number of security levels. Usually, they go from -1 to 2, with 2 being the most secure and restrictive, often including cutting off all network access and marking all the storage mediums read only, though the details of what each level does vary from OS to OS. Only root can raise the securelevel and even root cannot lower it. This would be used if you suspected an exploit had been successful. You could raise the securelevel to 2 which would prevent writing to any disk, mounted or not. This requires user intervention though and would not happen automatically.
