I guess technically Google flagged the site while the malicious files were still being hosted; it's not that they flagged the site when it wasn't hosting malicious content.