I think you oversimplify, @Scoresby. Bitcoin is very complex.

"Bitcoin works because consensus rules are all that matter" is false. There are many more critical success factors at play. It's not that one day Satoshi implemented "consensus rules" and Bitcoin came to be and succeeded. (As a side note, Satoshi himself changed the rules many times).

Both consensus rules and mempool filters are needed and also both of them need updating (fixes, improvements etc.).

Regarding the malware Core v30 - there isn't any (formal) reason for meddling with the mempool policy default settings. The author Gregory Sanders hadn't informed about one. Instead, he and his co-workers dictated it and later gaslit about the change. Two years earlier, the same change had been requested by Peter Todd as he had taken $1000 bribe from a simp for Ethereum guru Vitalik Buterin, to do it (source: GitHub repository). Peter Todd deployed malware on Bitcoin nodes a few weeks ago. He exploited the well-known vulnerability (P2SPAM or so-called OP_RETURN) in Bitcoin protocol. The impact of the vulnerability had been moderate throughout the years so there hadn't been pressure to fix it immediately. Virtually all node runners relied on the mempool policy to somewhat mitigate the issue. Core v30 unilaterally breached the status quo, doing so against Bitcoiners who run honest nodes.

The time to fix the P2SPAM vulnerability has come, apparently. The security patch will affect code of consensus rules. Bitcoin has always been P2P monetary network and releases of Core malware don't invalidate the statement.