[JonChesterfield]

Maybe, I'm not totally confident about there being a meaningful difference.

If the former counts as distributing malware, my bash script that clobbers local directories to put the machine back into a sane default state might be too. It does rm -rf ~/$DIR and similar. It's just not as successfully deployed.

Or software that wastes resources, maybe it goes into an infinite loop and DoS the local CPU. I've got one of those called 'heater' or similar that I used to warm up a macbook in a cold office. If someone ran that on cluster it would be unhelpful.

Maybe the change in functionality to malware from a widely shipped useful product is the key distinction, coupled with limited disclosure of the behaviour change.