It's one of the few non-futile uses of developer resources, when it comes to security. It's a virtual certainty that users will download malicious code, so as

It's one of the few non-futile uses of developer resources, when it comes to security. It's a virtual certainty that users will download malicious code, so as a security person you're left trying to mitigate the impact when they do.