Thank you everyone for your responses! I didn't consider the possibility of malicious code coming from other sources at all, so thank you for explaining that to me.
My question has been answered, but no-one has actually posted an answer, so I can't mark this question as answered. What's the proper etiquette here?