Here's the deal: That still doesn't mean it's not crapware.
You mention the difficulty of funding your download site (built almost exclusively on supplying other people's free content). I can't imagine what the bandwidth costs must be on a site like that. I'm sure there are plenty of other visitors on HN that are familiar with this issue and are daily encountering similar ethical decisions about how best to fund their business.
There are many ways of resolving difficult ethical decisions. http://en.wikipedia.org/wiki/Normative_ethics One useful technique is to ask yourself: If everyone behaved in this manner, what kind of world would result?
So let's imagine such a world:
* Want to view a .pdf on the web? ... receive and run an executable downloader from an unrelated party.
* Want to watch a video on YouTube? ... receive and run an executable downloader from an unrelated party.
* Want to install an application? ... receive and run an executable downloader from an unrelated party.
Do you see the problem here?
(Maybe you don't, but most everyone else on HN will and I'm doubtful that you're even reading the responses. But if you are still interested I'm sure we can politely explain it further for you.)
Downloading and installing software is an activity that is fraught with peril. The authenticity of the app you're downloading is critical and almost all the security properties depend on it.
If you think that breaking app authenticity is a great marketing opportunity, well, your brand will do no business with me or those I advise.
Whether CNET passes their own wrapped installer through VirusTotal is a good question, and I for one highly doubt that's the case. Who knows, maybe they tried, got a hit for malware and decided that they would ignore it because it would be counter productive...