I think you’ve got it wrong; no malicious payload need be on your box already. That’s not what the article says.