So the site is clearly parasitic, doesn't add anything and detracts from security. The term "malicious" does imply a little more to me though, like it's actually serving me altered software.

I guess the question is whether doing this (injecting yourself into the download flow for an open source piece of software and profiting via ads while doing so) is "malicious". I can see an argument that it is, as at the very least the site very much looks like it's the official site unless you read the small print.

I don't get the ads on that site at the moment. I assume they are the fake download button type of ad?

In any case, we can fight this particular site, but as you point out if this is generated content then I don't see how we're going to manually fight the coming onslaught of similar endeavours, so if the search engines can't keep generated content off their results (and so far they haven't been able to), it's going to be an interesting few years.