This is getting more and more common. I already refuse to do any free work for interviews, but in the future I will certainly accept the request and then deliver something that looks innocuous but is actively dangerous to deploy to production or to use in any way.
Good luck holding me accountable for that. I don’t even work there!
These companies deserve what they get. And I’m willing to give it to them for free, good and hard. Heh.