I'm unfamiliar with many of these certificates, but is there any reason such 'scamware' woudln't be able to get one even though it costs money? Because, if they still can, they the whole certification business definitely seems like a big scam to me.
The certificate authority should revoke their signing certificate if their binary is found to contain malware, returning them to the big warning state.
