I agree that it's not good, yet anecdotally I've realized that a device has been compromised by running `top`, on Windows and on Linux. It's not a good heurestic because it's only disvoverable post-compromise.