The same goes for any software

Agreed, the risk is just particularly high for little gizmos targeted especially at bitcoiners.

The risk seems higher, but I'm not convinced that's anything but cognitive salience.

There's nothing really unique about this compared to any other app that you allow to run on your computer. It's a great reason to only install from trusted sources and be very wary of cracked software, keygens, etc.

Well, a higher percentage of users of this are likely to be interested in bitcoin. Since what matters is "total number of bitcoin wallets you access" and misses don't really cost you much, I don't know that it matters, though.

Definitely true a bitcoin-related app is going to have a much greater percentage of hitting people with bitcoin wallets than, say, a crack for photoshop. But, the point being that any software from an unknown or untrusted source should be installed with great caution.

Misses definitely cost something. PPI (pay per install) affiliate programs have a floor price (iirc about $0.10 - $0.50 per install last i checked). Its higher than e-mail spam, but even that has a price. Targeted traffic costs more, but has higher conversion ratios. I don't think bitcoin wallets are so generic that you'd get a measurable number of wallets on generic traffic. You'd have to get many thousands of installs to even get one.

Is there a pay-per-install affiliate program involved here?

Your claim that "misses don't cost much" wasn't about the OP, it was about a hypothetical thought experiment. At the very least, misses cost the labor/opportunity of building, marketing, and distributing a generic executable (eg malware inside a windows screen saver). PPI payout rate provides a market estimate of the cost for that service.

Ah, your argument was "a miss here is a missed opportunity to do something else, so they should be pricing in the opportunity cost." Valid, I think, but I've got to give the ramifications more thought for any sort of substantive response.

I built a Docker image so you can run the script safely in a sandbox without even installing Node.js:

$ docker pull mlgx/turingou-btc

$ docker run -i -t mlgx/turingou-btc

You can also run it as an unprivileged user (in osx, I think the user `nobody` might be a good choice).