It's not even a hypothetical, this has already happened at least once: https://en.wikipedia.org/wiki/Operation_Trojan_Shield