Yes, that is right. What I meant that it won’t be implemented as a single thing that observes everything, but instead each app will have its own malware inside. Otherwise sandboxes could probably handle this more easily