Your theory that it was just malware is easily disproven by reading the bug reports and blog posts from the years people spent trying to make this work.
Firefox found far from universal success even after years of testing and blacklisting known-noncompliant servers:
http://bitsup.blogspot.com/2012/11/a-brief-note-on-pipelines...
(the actual blacklist at the time
http://hg.mozilla.org/mozilla-central/file/1d122eaa9070/netw...)
Opera's implementation apparently relied on some non-trivial heuristics but they apparently weren't well documented and were discontinued with the transition to Blink.
Similarly, it's easy to find cases where people discovered real problems in the wild with the iOS implementation:
http://tech.vg.no/2011/12/14/safari-on-ios-5-randomly-switch...
(This also affected Mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=716840)
https://github.com/AFNetworking/AFNetworking/issues/528
It's easy to understand why people decided that it wasn't worth investing so much time in this when HTTP/2 would deliver significant additional benefits and by using TLS as a starting point could provably avoid the worst tampering proxies entirely.