Recent versions allow quarenting on behaviors, like flashxxx.ocx tries to write to c:\windows\.... Figure out the function hook, and you can bypass these actions before they occur.
In addition, any encryption keys embedded would be fair game. possibly allowing to impersonate a live update server.
Reasons it's not relevant:
Any decent virus writer has disassembled it more than a Jetta in your average chop shop.
Corporate IT departments rarely read Vendor best practices and miss the boat on writing to system directories, registries, and other common ways to infect a machine.
Impersonating/Man in the middle attempts with encryption keys are a PITA to employe, more effort than anyone skimming account numbers would care to carry out. Now targeted attacks are another story.