It's about the target. If you write dubious code and deploy it on other people's machine, it's that deploying part that makes you a criminal.

If you simply write dubious code to keep to yourself, you're not a criminal. I mean how else would you teach others how to protect themselves from dubious code?