Stuff like this doesn't belong in sysvinit. It belongs in an optional package that can call shutdown, not in shutdown itself. Let alone in the halt binary!
Fine, I wouldn't object.But I would point out that (1) you don't loose any modularity with a pam layer, since you can configure pam to require or not require just about anything you want and (2) such a code change is hardly an unprecedented security risk -- login, for example, has already been pam-ified.