i didnt talked about smart card generally, i talked about rockey and specially rockey5. extraction of code is possible, exactly becuase they let developer to add some code to card. and code can be a trojan, and ....
i think you can underestand what i am saying about. . you can ensure that this is done before.