When deciding whether or not something is malicious, I don't think "they could have done something even worse" is the standard you judge it by. I think you're definitely right that they could have done worse but I'd argue it's already pretty malicious as it is.