It depends on where the malware resides. Let's assume you mean : some program running as your user and wanting to get privileges.
Really short X security primer
First, you have to be aware that X does some access control but does not isolate between connected clients. Every client connected to your desktop can query the server to obtain information about any other X client and interact with it.
For example, if you run Skype (or whatever program, open-source or not) on your desktop, it can spy activity : list windows, their titles, take screenshots, log keypresses, even (with some graphical toolkits) figure out the structure of what it's currently displaying. So in theory it can locate if you have a terminal with a root shell opened, send keypresses events to type something there (though not all terminal emulators obey these).
In practice simulating keypresses may be noticed by you (you see that something happened, or maybe the program could just close the window after doing the job to hide it), while plain keylogging is invisible (especially) if the program is authorized to communicate with the outside world through an encrypted connection (instant messaging, audio and video programs for example, that includes Skype, Google Talk, Flash and other plugins).
Reference: The Invisible Things Lab's blog: The Linux Security Circus: On GUI isolation
Answers to your questions.
In situation 1, you basically trust iotop but I guess that's not your point. Let's imagine a malware connected to your desktop or running as your user. It could try to trick iotop into doing something nasty (by simulating keypresses, etc.) but it would probable be ineffective.
In situation 2, the shell is separated from X, so it's better security-wise. You have to know that one program running with your user account can write on a Linux virtual console where you're logged in, but it's only inserting characters on the screen, not process activity. AFAIK you can't trick a program into actually typing something into another Linux virtual console.
Situation 3 is what's explained above. A program could notice that, type some commands and try to hide the fact.
If you're really concerned, you are probably interested in security by isolation and Qubes.