May be this would be useful though?  Compromised container that sysadmin paused?  Maybe they want it destroyed from paused state.. ?