That's a very disingenuous phrasing. They were hacked. Maybe (probably) due to bad security practices, but they didn't intentionally distribute malware.
You’re right. I’d edit my comment, but it looks like I can’t anymore.
link? Because the only time I can think of is when their website got hacked and the developers sent out notice as soon as they found out.
That’s it. As a sibling comment mentioned, I did not phrase that well.