No, they’re wrong. They were wrong as soon as they said a Trojan you have to install yourself, which is exactly how it works. It can’t work if you weren’t tricked into installing it. The Trojan doesn’t have to cause harm it’s called a Trojan based on the way it has to be deployed.