Well, just the other day, someone posted a article that reveals Malware that were for sale to target Bitcoin ATMs. So, these guys are not just targeting Fiat ATMs. If government sanctioned attacks are launched at Bitcoin ATMs and people's private keys are hijacked or coins re-directed, then this will have a huge impact on people's ownership of coins.
They may lie dormant, until they gathered enough information and then shift massive amounts of coins from "active" wallets in one sweep.
They may lie dormant, until they gathered enough information and then shift massive amounts of coins from "active" wallets in one sweep.
Once the malware is established, it's not hard to divert transfers to other wallets or make the coins "disappear". Maybe they are just collecting information as much as possible like you said to wait until the ideal striking moment. I'm not sure if I would trust ATMs anyway.
In reality they can intercept payments but not get into wallets from these codes, especially if you keep your wallet cold. Safe practices can avoid exposure to risks like this. There's too many bandits in this wild west trading environment.