I think you are absolutely right about how easy it is to fall prey to lots of money for adding a simple payload.

In the early days Wordpress sold use of their domain to black hat seo / spammers.