and convinced yourself it didn't cause unexpected side effects.

Put a one month timer in your malware, and this would get past many of such attempts to ‘prove’ the software isn’t evil.

Add a few countermeasures against clock shifts (e.g. only be active a few minutes each month or only activate when a) enough time and b) enough user interactions have passed from the first run), and you’ll effectively get past most, if not all, of such black-box testing exercises.