The meta-game at this point is open to just about any type of psychological trick. We know/suspect Kaspersky helping FSB/GRU, but we also know that CIA/NSA store and use fingerprints from other nation states and can assume Russia does the same. So if something looks Russian but Kaspersky reports on it, does that mean it is NSA trying to false flag Russia? Or is it Kaspersky deflecting Russian suspicions and pointing to the US by bringing it to light...6 years later?

The abilities and willingness of certain nation states to wage cyber warfare and make it appear like someone else are so great at this point, that only solid forensic evidence, and usually not even that, can be indicative.

They have and they do.

https://securelist.com/masha-and-these-bears/84311/

The way to understand this sort of thing is to try to think like someone in their shoes.

First, you're innocent. What would you do over time to try to survive the accusations and suspicion?

Next, you're implicated in past bad acts. Maybe you were forced to stick malicious code in a past version, or maybe you had a rogue employee. What would you do to try to move on?

Finally, you're an active part of the state intelligence apparatus. What would you do to try to appear like one of the other hypotheticals?

There are other possibilities; people get themselves in all sorts of weird situations, but most of them are some shade of the above.

If you are an av company you can't just whitelist every other piece of malware.