I don't get why they would bother actually using a controlled website to actually distribute malware. It seems more valuable to just sit on it to collect user

I don't get why they would bother actually using a controlled website to actually distribute malware. It seems more valuable to just sit on it to collect user information. Eventually on of those websites will also do something unsound like storing passwords as plain text, or a vulnerability that can get you the passwords will come up.