There's a difference between malware and a 0day. Malware just causes harm to the endpoint. A 0day proves that the potential for a security breakdown is real.