My assumption is that what they have full control over is the admin/CRUD interface that is on top of the database that their malware is feeding. They tightly co

My assumption is that what they have full control over is the admin/CRUD interface that is on top of the database that their malware is feeding. They tightly control the access to that data which is probably encrypted on the target device. That admin interface probably also is where the targeting is done so they could easily put anything they don't want targeted behind a disallow-list.