There's no reason the code couldn't just blindly try every attack until it finds one that succeeds. If there's a malicious app that runs a lot (lookin' at you,

There's no reason the code couldn't just blindly try every attack until it finds one that succeeds. If there's a malicious app that runs a lot (lookin' at you, random firefox tab that eats 99% of my CPU for minutes at a time and then goes idle again), it has all the time in the world.