Ultimately, there's little difference between incompetence and malevolence when acting in this level. Incompetence might actually be slightly worse.

The malevolent act on their best interest which is often predictable and limited. The incompetent simply give away data to every random badguy under the sun.