That. They could’ve just supplied a default .profile / .bashrc. It’s these kinds of bells and whistles that causes most security bugs due to additional attack surface. Is it the root user fetching the news with wget/curl from a remote source?