Attacking Tor by passive analysis is one thing. Installing spyware, creating a botnet, and making the infection process quick and easy is another. There might be some justification for the former. The latter is too risky.
I don't think there is really an analogy here.
Malware is a fundamentally targeted endeavor since known exploits get patched.
The question of course, is are the targets legitimate?