Wait. So... making executable code available to hundreds of millions of users on a storefront they trust just takes sending a forged HTTP request?

No cryptographic signing process? No automated software analysis and sandboxing? What the hell was Valve thinking? Watching paint dry is pretty much the best case outcome for something like this. It could well have been Mass Effect 3 on Steam for $5, yet the actual code being ransomware...