Isn't it already game over if malware can write into your hostfile? At least on Windows you need some elevated access for it, which means such malware could just read/write the target program's memory directly instead of resorting to clunky MitM.

If malware can write my hosts file it's probably all over anyways, it has admin access and just keylog everything and pull passwords directly from browsers.

I'm not saying it should be the default, I just want an about:config option to disable them (they used to have one for the insecure password field but it no longer works).