In some detailed examinations, if you're quite pedantic, there are no "from" addresses in Bitcoin. Which I only mention to lead into: more concretely there may

In some detailed examinations, if you're quite pedantic, there are no "from" addresses in Bitcoin. Which I only mention to lead into: more concretely there may have been no easy way to tell when there was a spend "from" a certain address with the tools they were using to check. "Have I been paid yet?" is a much better supported use-case in Bitcoin than "Hey let me know when I just sent out money", so it's quite easy for the tooling for that to be easier to find. And malware authors are pretty lazy generally.