It is only a threat if it can be leveraged. Deeper heuristics on the deviations in that telemetry from normal could also have provided a signal that something

It is only a threat if it can be leveraged. Deeper heuristics on the deviations in that telemetry from normal could also have provided a signal that something was off -- like the temporary file replacement activity. Without telemetry that kind of activity could likely continue undetected for longer.