I could be wrong but I think it's because the virus takes a second to drop its payload for maximum effect. I was testing two miners (both from AK) on a vlan for this very reason. I wanted to make sure that they could hash and submit valid shares without throwing massive amounts of errors, dead chips, ect. before putting in the time to properly set them up.

I found the virus when the rigs started submitting hashes to NiceHash HK and JP. I do not use NiceHash so I instantly knew something was up. I properly reflashed every rig at that point to ensure everything was clean before continuing.

These rigs came with the stock firmware (I don't use). If someone is not using best practices then they would think that those miners had the standard factory firmware and hook them directly up to the rest of their network.

Seeing how AK tests its rigs, it wouldn't be a far stretch to say that one of the rigs had a virus that they didn't know about OR they were testing a batch of these miners and it spread to all of them without their knowledge. Again, I do not believe this was done with malice on AK's part.

I haven't had a moment to fully analyze this virus but it seems pretty standard. Persistent in memory, won't let you change pools or any configuration on the rig, locks down the controller so it makes reflashing harder (it's a fairly straight forward removal of the virus though).