So every C++ compiler that allows you to build in the run-time library with a flag is malware? The user in this case used the /MT flag which tells the compiler

So every C++ compiler that allows you to build in the run-time library with a flag is malware? The user in this case used the /MT flag which tells the compiler to inject code by design. The issue here isn't with injecting code, it is with what that code does. I'm sure many would find the lack of informed consent offputting, and I'd agree. This "feature" lacks documentation and or a warning.