I think this is a reasonable question. The moment this activates and exfiltrates or destroys a system the entire model family, training pipeline, and company are burned, no? How can you construct plausible deniability if your model will (presumably deterministically) activate on trigger?

Nation states aren’t looking for a return on investment rather they have a particular objective they want to achieve, e.g. stuxnet or the pager attack.

Sew a million seeds, see what grows.