This ad-hoc approach looks very suboptimal as a threat detection heuristic. Judging about your system’s security by whether there are binaries that behave in up

This ad-hoc approach looks very suboptimal as a threat detection heuristic. Judging about your system’s security by whether there are binaries that behave in upredictable ways means a game of whack-a-mole against buggy programs (which is 100% of them, remember?), while letting real threats go by. A way of making sure your binaries are trusted is supply chain security, which starts with not obtaining them through unvetted sources. If in that situation a known-trusted man says a funny joke at midnight, your spidey senses would not be triggered. In other words, if there is a way for suspect binaries to get into your system, you have a bigger problem. If there is no such way, you can be sure it’s benign behaviour, a bug in the program, an Easter egg, or even a bit flip or some unlikely interaction of factors. If you are not sure whether you have eliminated all such ways, sure, it might seem like a cause for worry—however, I don’t think attackers you should really worry about would try to make themselves noticed through jokes with Western cultural references (or through any jokes for that matter, or in any way at all).