I'll go with number 3. She didn't just say "don't run", she said "uninstall". That doesn't sound like "misleading" or "uses too much resources". It sounds very CVE-ish.

"uninstall" points at a very specific type of exploit.

Assuming it's actually necessary to uninstall.

It might just be that "uninstall" is the simplest one-word advice you can give that will definitely solve the problem.

Another xz case?

That's what it smells like but this is still a weird way to disclose something like that. I imagine some people with free afternoons are taking a stab at auditing atop's PR history right now. I'm not personally up to the task, but the fact that the top 3 contributors other than the original author are ByteDance employees might cause some to jump to conclusions.

Does atop have any legitimate need to connect to the network? I can’t think of any legitimate accidental security holes that might show up in something like atop, but then, these utilities often have funky features I don’t know about!

If it was 1 or 2, there would be a long Rachel-style post ranting about it and explaining exactly why.

It has to be 3.

And she knows her stuff, so I'm listening. Luckily we don't use atop.

But if it was 3, why not say "I know there is a vulnerability, but I can't share the details"?

I'm not saying it isn't 3, but if it is, it seems like there might be more to it than a run-of-the-mill CVE.

Or maybe she doesn't know of a specific vulnerability/backdoor but has some reason to be suspicious there might be.

1) is possible because it uses some interesting options like nice/mlockall/changing its oom score so if the atop process went out of control your box would probably be fucked.