This would be a really easy "security" measure to circumvent, though - I could literally just delete your monkey patch, for a start!
Though, you do raise a valid point, so let's see how it plays out.
setTimeout = function(){...} delete setTimeout // true - you've removed the patch window.setTimeout = function(){...} delete window.setTimeout // true - you've removed the patch window.constructor.prototype.setTimeout = function(){...} delete window.constructor.prototype.setTimeout // false - the patch is still there!
Maybe there's some other way of getting to the built-in setTimeout so you can create your own version to mask the one I added?
EDIT you can embed an iframe and rip the native setTimeout from there.
This would be a really easy "security" measure to circumvent, though - I could literally just delete your monkey patch, for a start!