While this might improve the possibility of a "true positive" correct attribution, wouldn't it also increase the possibility of a "false positive" incorrect att

While this might improve the possibility of a "true positive" correct attribution, wouldn't it also increase the possibility of a "false positive" incorrect attribution? Taking data from numerous sources probably help to attribute the malware to someone, but I could imagine a motivated actor putting some dummy code in their binaries just to trip some of the detectors.