As I remember it, ads/malware trying to look like install (or download) links have been common for the last 10 years - to the point of training me to ignore any image that has the word "Download" in it. Choco helps work around much of that.

It's more concerning to have official installers contain adware/malware though.