Hi,
To believe that only free modules are used as a gateway for hacking is a blatant mistake.
100% of the hacks I've been working on for months are related to paid modules.
Some information: https://www.mediacom87.fr/en/proactive-or-corrective-prestashop-security/