From Freenode #dbus IRC:
```
11:53 < smcv> thp: on the system bus, method calls and replies can't be monitored under the default configuration (we want to let root "eavesdrop",
              but it's technically difficult)
11:54 < smcv> thp: on the session bus, think about how an attacker could subvert the session bus to monitor them anyway, e.g. by attaching a
              debugger to it (ptrace)
```