To answer your question solely because I don't like FUD driven phears monger int
discussions
RPM based depsolvers select packages based on heuristics, including what is already
installed.
Any malicious package that had Provides: glibc would most likely be ignored because glibc
is already installed.