If Spotify won't respect the users rights and take responsibility and assume liability when Spotify distribute malware, why should should the user respect Spotify rights? Society is built on shared respect and the current online advertisement operates on the opposite model.

The reason why every large service on the Internet is ad-supported is that it does not need to follow advertisement laws. They don't even need to follow computer crime laws. If society would start enforce such laws onto online services we would see a major shift away from ad-supported services.