Services added in hook_services_resources_alter() cannot be disabled

In _services_build_resources(), I notice that the settings for disabling individual services are applied prior to the alter hook:

  // Load the endpoint
  $endpoint = NULL;
  if (!empty($endpoint_name)) {
    $endpoint = services_endpoint_load($endpoint_name);
    // Apply the endpoint on the services
    _services_apply_endpoint($resources, $endpoint, TRUE);    //<--- services disabled here
  }

  drupal_alter('services_resources', $resources, $endpoint);   // <--- you added something else after

If someone ended up adding a service via the alter hook, rather than the base hook, it would be unintentionally exposed although appearing to be disabled from the admin screen.

Granted, the new service should have been added in the base hook, not the alter hook, so the fault really lies with the person making this new service. However, I think a fix for this would be simple, so it doesn't hurt to cover for this possibility.