Malware would explicitly have to be executing a terminal for a window to popup. They can just call a shell directly.