And detected mostly because the automated script kiddie set up a cryptominer to generate $0.0001

There are way more valuable and destructive ways once you have RCE like:

• Searching for committed API keys "anyway my repo is private"
• Ransomware in case there were no backups