So you think making bad business decisions is holding up to fiduciary duty? You can't throw money at every problem that you'd like to solve, calling that malice is silly was the point I was trying to make.
Neglecting all other ethical duties beside profits is so close to malice it takes ...an, ah, expert, to tell you the differences and how important they are.
And this neglecting all duties besides profits thing is real, it is institutionalized by decisions of investors, by managers hired by investors, by regulators "captured" by investors and so-forth. It is the norm. But that doesn't it's a legal or ethical that a given manager or employee has, at least not currently.
Paying staff to avoid distributing literal malware on your platform is not a bad business decision. And even if it was - yes, bad business decisions are within the scope of fiduciary duty. Have you ever seen someone successfully sued under this clause for making a bad business decision, in your life? Fiduciary duty is more like, you can't take the money and run or pay your nephew a $10,000,000 salary to play ping pong in the office. As long as you're not doing something clearly, intentionally harmful to the business and investors, you're clear.