Hackers are already leveraging these over-permissioned programs to access the IT systems of major security vendors.