But unless you already know who they are, how do you get malware onto their machines? The Tor Browser Bundle has been carefully tuned to minimise attack vectors

But unless you already know who they are, how do you get malware onto their machines? The Tor Browser Bundle has been carefully tuned to minimise attack vectors, so it could be quite hard for people who use Tor "correctly".