Counter-anecdote: I've played a game where the developer included a bug that gave other players arbitrary code execution on my PC and left it online while fixing the bug. I've never launched it since and had owned it less than 48 hours. Steam rejected my refund.