Interesting that this was discovered after embarking on a journey to understand how widespread the use of Lua is, in the exploits realm ..

I also wonder why they opted to make this an injectable worm and not just a side-loaded 'feature' of the OS?

What would the difference be? They would have the same effect.