The malicious code could use life-before-main hacks to gain code execution if it's linked at all, even if uncalled. https://grack.com/blog/2026/06/11/life-before-main/
It doesn’t take away from the point that build time often has access to secrets the runtime does not.
It doesn’t take away from the point that build time often has access to secrets the runtime does not.