Because someone in the 1970s-80s (who is smarter than we are) decided that single-user mode files should be located in the root and multi-user files should be located in /usr. Somebody else (who is also smarter than we are) decided that it was a stupid ass solution because most of those files are identical and it’s easier to just symlink them to the multi-user directories (because nobody runs single-user systems anymore) than making sure that every search path contains the correct versions of the files, while also preserving backwards compatibility with systems that expect to run in single-user mode. Some distros, like Debian, also have separate executables for unprivileged sessions (/bin and /usr/bin) and privileged sessions (i.e. root, /sbin and /usr/sbin). Other distros, like Arch, symlink all of those directories to /usr/bin to preserve compatibility with programs that refer to executables using full paths.
But for most of us young whippersnappers, the most important reason is that it’s always been done like this, and changing it now would make a lot of developers and admins very unhappy, and lots of software very broken.
The only thing better than perfect is standardized.







The technique is called steganography, and the product is called stegomalware. The payload is concealed as part of some legitimate file, like the pixel data of an image file. It requires the reader software on the targeted system to already be infected, or to have a vulnerability that the payload can exploit.
Low Level video: https://www.youtube.com/watch?v=89ysXVYH2Sk (one more reason to hate Webp)
Quick example by John Hammond: https://www.youtube.com/watch?v=JBIbL8zwZOs