been thinking about this too. let’s say someone included an illicit/illegal piece of data in the binaries of a OSS project. Are users at risk?