Hypothetical scenario:
You buy a piece of software, marketed to photographers for photo editing. Nowhere in the manuals or license agreements does it specify anything else. Yet the software also secretly joins a botnet and participates in coordinated attacks.
Question: are you on the hook for cyber-crimes?