Yeah, it makes very little sense to “play the long game” on a private site to spread malware to a small user base when you could just go to any public tracker where it’s the Wild West. Could someone do it? Sure, but it’s really not realistic to expect that regularly.