&gt; <i>Devil&#x27;s advocate: where does this line start and stop?</i><p>I would say that it stops as soon as the venue starts doing any reasonably in depth vetting -- or even more, actively curating -- what they&#x27;re serving. In this case, Google already has a malware detection service that is hooked into their browser, and this malware detection service can reasonably be expected to catch sites like download.com that serve trojans.<p>Download.com actively choses what to provide for download, and actively makes sure it has malware.<p>&gt; This is not completely analogous to serving malware, but the onus is not on the store to vet the products before selling.<p>Sure it is. If the store sells low priced crapware, then it&#x27;s 100% the responsibility of the store. The difference here is that the crap that they sell is legal, non-intrusive, and can generally be returned for a refund.