> It wasn't until the OS started alerting the user to this clipboard read that it started to look very suspicious.

Maybe sprinkle in a bit of users didn't consider it suspicious until it was reported that some apps were abusing the privilege.