I would indeed not attribute this to malice from a one-off bug if support then picks it up reasonably. Malicious would be not having or supporting a delete-my-data feature