And even in the ones that don't, having to wait until the project executes to begin its attack is a minor inconvenience for malware.