If the past decade of my life has taught me anything, it's "attribute all malicious actions to malice." It's usually just a matter of direct vs. indirect malice. Meaning, are they directly benefiting from their malicious actions or are they just assholes who "do it for the lulz".

The malicious actions are just at the potential stage at the moment. Someone has the capability to mess with our buses by means of a remote software update.

Just like someone has the capability to do with virtually everything we have running software.