Their ethical obligation would also be to err towards full disclosure, not away from it. Google's original view of the situation was that installers like this

Their ethical obligation would also be to err towards full disclosure, not away from it. Google's original view of the situation was that installers like this make devices measurably less secure (to which Epic's response was pretty meh), and the installer being exploitable to install pretty much anything only proved that point and then some. ...and frankly, it would not matter who wrote the installer if it got used for a mass infection and attack. Google would still get the bad press and a generous helping of blame because of the trashy way so many "tech reporters" behave to get those mouse clicks.