I submit that the "is malice or incompetence" heuristic can be broken by pathological inputs which result in an indefinite runtime, and that we've encountered some of them in the last decade.

The correct response when that happens is to say "both" until/unless the perpetrators want to plead just one or the other.