If I make a toolbar that, I dunno, provides human-edited translations of Wikipedia articles that's active when you're on Wikipedia.com, and I monetize that by putting ads on the page, and a user downloaded and installed the app (as opposed to me paying to bundle it with another app) that is not malware.
Look, to the generally-non-technical audience that the original Wikipedia article had to write for, I think it's fair to cast a wide net and name all offending apps malware.
But here, amongst professionals in this industry, it's absurd to me to not see the nuance.
I agree that in that particular case it wouldn't necessarily qualify as malware, if you've made it clear to the user what you're doing. I would certainly call it adware, though.
And as you suggest, if you snuck it in along with some other application where the user didn't necessarily give clear and well-informed consent to install it, then I would absolutely call that malware.
User consent is typically given to yield some kind of functionality not to inject ads on pages the functionality is just bait.
That's just misdirection, it's not even clever it is simply bad. And whether we're talking about data in transit or stored on the computer is bickering over details.