It could be done by signing the transaction with the owner-key/password, that way, even if a bad actor gains access to the active key, he can only power it down within the normal time.

On top of that, theoretically, we could enable to multi-key signing, where the powerdown can only be started with a burn, if the transaction is signed by all accounts. For example:

Bob enables the power-down-burn option with his owner-key, in addition, he adds another account bob-cold as a required participant in multi-sig. Only if a transaction is being signed with both bob's and bob-cold's owner keys, the instant power-down via burn is being allowed.