Paying staff to avoid distributing literal malware on your platform is not a bad business decision. And even if it was - yes, bad business decisions are within the scope of fiduciary duty. Have you ever seen someone successfully sued under this clause for making a bad business decision, in your life? Fiduciary duty is more like, you can't take the money and run or pay your nephew a $10,000,000 salary to play ping pong in the office. As long as you're not doing something clearly, intentionally harmful to the business and investors, you're clear.