It becomes a defensive against hacking legimate sites.

Anyone could hack a site put malware and if they are caught claim they hacked in to remove the malware they put.