So the malware is running in the user's context, and has the browser's window handle and instead of using that to hook the child input elements directly, they're going to store an unintelligible stream of keystrokes then use the window handle to bundle that with the window's title? Is that a reasonable way to implement malware? Will it result in high quality data for resale?

One of those "Things programmers believe about malware" articles needs to be written. There's a lot of "Schrödinger's cat"-level thinking going on, wherein malware is both running with full rights of the user while ALSO somehow needs to rely on raw keystrokes to record anything.