My point is that we know there’s spyware on the image, so we should suspect malware elsewhere as well. Until the hardware is audited, we should assume that hardware is compromised as well.