Do you not know what loading a recovery snap shot does? It doesn’t matter if it escapes. Whatever was new is removed since it’s restoring your harddrive to a previous state. It’s like a backup harddrive, without being external.

There’s ways for the malware to disable recovery mode, but I would assume the same could happen to Linux as well.