This is rather damning for other reasons that people may not even realize. DARPA is a rather fast moving agency, and DARPA grants can be fairly short term with a fast turnaround in comparison to say NIH or NSF. Thus for DARPA grants (and others, but especially DARPA), it's extremely common have already started some aspects of the research in order to make the timelines in the grant achievable. Thus as someone in a nearby field (not something with such hefty security issues, but bio-related), when I see it say that they wrote down they wanted to insert this site into the virus, that is a public admission that someone in some lab has already started gathering preliminary data showing that it could work.