Really then, a tape recorder should be considered a munition under that logic.

Malware shouldn't be considered a munition any more than encryption should have been.

Unless the malware actually makes your phone explode, then it's a stretch to call it a munition.

Do we really want governments getting into the code review business?