This is a failure of malware flagging systems as well - VT should not return clean if there are any downstream files that are malicious - such as in this case.