I think your logic is flawed. Banner ads are explicitly permitted by the web site operator (they get paid for them after all). Plugins aren't permitted by the web site operator, however they are permitted by the user, who has to explicitly approve installation of the plugin. Same with malware browsers: the users chose those. Of course, the users were ignorant and clicked on something they shouldn't have, but still it's ultimately their own fault: they opted in.

It's different with Microsoft: MS never asked for users' permission to change content, nor did users ever expect it.