What happens to quality assurance when malware starts modifying systems? When malware starts modifying systems that have already been modified by other malware

What happens to quality assurance when malware starts modifying systems? When malware starts modifying systems that have already been modified by other malware? Seems like a mutual game of Russian Roulette. Any attack that is not perfectly executed risks harming the system, even if the malware is never activated. This happens all the time with software upgrades that have been vetted. Are the spies doing regression analysis on the effects of their implants to make sure they don't accidentally break something?