You could argue exactly the same way against US security firms such as CrowdStrike, and a few others, which seem to focus on uncovering Russian malware.