I assume that's correct, for your very narrow definition of malware and a nonzero definition of zero, and it's a good point that trustworthiness is context-dependent. As Alan Karp used to say, "I trust my relatives with my kids but not my money. I trust my bank with my money but not my kids."