That statement is false. The person who wrote the malware could have no idea on how the program would be used. ( The releaser of the malware on the other hand, tend to have the full knowledge on which type of information they're intended to take by spreading the malware. So the punishment of the releaser tends to be significantly higher.
