If you were a malicious actor do you really think this method is going to offer the greatest return on investment?

Nation states aren’t looking for a return on investment rather they have a particular objective they want to achieve, e.g. stuxnet or the pager attack.

I think this is a reasonable question. The moment this activates and exfiltrates or destroys a system the entire model family, training pipeline, and company are burned, no? How can you construct plausible deniability if your model will (presumably deterministically) activate on trigger?

Sew a million seeds, see what grows.