One way is to have vendors sign a contract guaranteeing that their products do not contain malware. If the product does turn out to contain malware, then Amazon has contractual and legal recourse to recover damages and refund customers their money.

Sure, this isn't perfect, and won't help much if the vendor is a shell company, but it does put vendors on notice.