It can certainly be "or": rootkits can come from your machine's supply chain, and lie mostly dormant for many months or years before activation.