I assume most people run the code they compile on the very machine they compile it on, so how does preventing compile-time system calls help stop malware?