I think few will argue it's ethically or legally fine for my website to pay by installing a keylogger through a zero-click Chromium RCE, burying it in the EULA.