it's not always the developer's fault. keyloggers are usually designed for legitimate reasons, like the FamilyKeyLogger by kmint21 is used to check what employees or family members are doing online, but people may decide to use it maliciously. That's a big no-no.