> You can’t import or require() a module that only exists in memory.

Sure you can. Function() exists and require.cache exists. This is _intentionally_ exploitable.