Not surprised. It looks like it's really just a malicious configuration more than anything.

Fortunately, I'm pretty sure you already have to be root to modify PAM.

I love a good nasty backdoor from time to time