Richard Clarke talks about his belief that stuxnet had numerous checks in place to limit collateral damage: "it very much had the feel to it of having been written by or governed by a team of Washington lawyers."

https://www.smithsonianmag.com/history/richard-clarke-on-who...

I think that purposefully built malware will have those checks hard coded into them in order to limit exposure. Will there be programatic flaws that cause it to spread farther? Yeah, that can happen. Q&A always is the first thing that gets cut.

I would suspect that the usage of more open ended tools/implants will have scope applied/enforced at the human layer. You don't want an employee going wild and knocking over everything just because they have a new 0day.

Thus avoiding detection as much as possible. It's why the flu strain that kills everyone within an hour doesn't spread very far.

I tried not to smile at that, and I failed. Pretty sure nothing is 'checking' them from collecting data on every U.S. citizen.