Thank you for the question.
Certainly, if you look at the structure under clause 6, you're quite right. It's saying that no person shall do this unless they fit into the category. I would argue that that's the appropriate way of doing it, for the following reason.
This area, obviously, is changing rapidly by the year, by the month, by the week, and if we tried to itemize the things that were accepted rather than having a blanket prohibition, we'd be getting into a situation where the legislation would almost be out of date by the time we got around to getting royal assent. That would be my fear. You'd be constantly seeking exceptions to the general rule of openness--which would be the opposite of this--because other methodologies would come forward that would be legitimate methodologies, or, in your case, other things would come forward that are bad--some new form of malware, some new form of spam--and then we'd have to plug the hole and say no, that one's excluded too.
So I think it's better to exclude everything and say no, everything's excluded. Assume it's spam or malware, unless you fit into what we know is legitimate commerce or legitimate communication under this particular bill.