Because they just switched domains (getdropbox.com to dropbox.com), they haven't built up a positive reputation on their new domain yet. As a result, only a handful of instances of malware being served by a user can get the domain blocked.
I wonder how effective this sort of attack would be against Dropbox in the future.