There's a niche field of malware economics, but it makes sense that for-profit malware is ultimately a business, albeit an usually illegal one, which has to optimize just like any other app:

https://cyber.harvard.edu/cybersecurity/Economics_of_Malware

https://www.coursera.org/learn/malsoftware

At some point, it would make sense anonymized malware (i2p, tor only) may go open source similar to commercial open source but instead because of scene cred / blackmarket consulting.