Don’t get me wrong, Vanguard is BS, and I quit playing riot games because of it. However, that in itself isn’t sufficient to classify it as spyware. I still haven’t seen any evidence that it currently does anything nefarious with that access.

To me, there are 2 problems: 1) It could be used for targeted attacks, and the likelihood anyone would find out is much lower than in a widespread surveillance scenario. 2) It could be used to deploy a massive bot-net.

I think the US reclassification here is precautionary in nature.