I am sure people disagree with me and agree with you. Fact is if I bundled up the latest version of Windows, Mac, BSD, Linux malware and ransomeware most here would be hesitant to copy it to their workstations, dev/qd, staging and production servers even if they did not wish to execute it. Very few would be able to prove it was never executed much less be able to prove what the code did or did not do.

If it's not needed it's gotta go especially if it can talk to the network or modify data/code that can talk to the network. I will always assume it is or was running, period full stop.