It tends to make the download link the wrapper software, which installs the malware and downloads the actual software. This lets them supply e.g. unmodified Firefox binaries but still malware you.