It would be more sneaky that way.

Me and many others grep for obvious functions/macros that are used heavily in backdoors like base64/eval/exec/mail/etc, this way it's ore sneaky. 
Tested on ver 5.3.13.