Your point is most starkly clear in the case of any open source malware.