How do you conclude that quietly integrating malware into an image viewer was done "in good faith"? Because the author didn't twirl their mustache when they did

How do you conclude that quietly integrating malware into an image viewer was done "in good faith"? Because the author didn't twirl their mustache when they did it and claimed surprise that people were mad?