Is the risk that malicious software can be split into multiple, obfuscated components? Without such a silicon vulnerability the malicious process would need al

Is the risk that malicious software can be split into multiple, obfuscated components? Without such a silicon vulnerability the malicious process would need all its components within a single process/image?