If the agent GUI is open, and a master password is required, there should be a timeout interval where the GUI locks again and you have to reenter it to get in backup.

Our big concern is that if a user account is compromized, by a hacker/ransomware person, they get on a machine with the GUI console open, they then have permission to go to Backup Storage and start deleting backups.

That would be a bad thing.