It’s an interesting view. In this case you are claiming the victims are bound to the creator/vendor of the software/service, not the hacker?