Can SuperSU be bypassed?

I'm wandering if SuperSU or another root management app it is capable of protect me against an malicious app gaining or doing root access on android phones. We know root is achivied by using exploits so assuming an attacker remotely install an app/script that will root your device and install other sofwtare without you realize (either by impersonating a tower or exploiting an app the mean don't matter) or convincing the target to download a malicious file that will do that. How SuperSU protect me against that and it is possible to an app bypass it and get the root access? If yes ,how?