It's also worth noting that are clear examples of closed-source software that essentially acted like malware. I've not heard of any such examples with IP cores.