It doesn't even need to be a hack, or a malicious new owner taking over a game or other software package that has such access.

The original company could be malicious/stupid/both. See https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... for the most famous example of “both”.