Sure. But the heuristic the TaaS world is using isn't something as absurd as "allocates 3 pages", it's "uses undocumented system APIs". We're also not arguing in the abstract that "they might make a stupid determination in the future", they're making this determination now.
I'm not a fan of the the security industry's practices, but I can't say they're making a malicious/stupid choice here.
I'm not a fan of the the security industry's practices, but I can't say they're making a malicious/stupid choice here.