So it would only be worth it if you are a high-value target and they are sure they can convince you to actually run the game. And it does not scale, because when they send keys to too many users and one of them finds out it's malware and reports it, the game gets depublished and they need to start from the beginning.
In order to pull this off, Evil Person would need to pay $100, wait several weeks for the Steam Direct process to complete and commit identity theft to avoid getting caught.
The malware needs to be a custom made one so it does not get detected by any known virus scanner (Valve does check every submission using virus scanners). With several hundred thousand FREE hacks, cheats and bots, over 4 million members strong, a free and open marketplace and a great community, what else is there to ask for REGISTER now for full benefits of our site, its completely FREE to join: Access to our large gaming community with millions of discussions to participate in. So it at least needs to look like a game. Steam's quality control is very lenient, but not non-existent. Evil person creates a game with a very well-hidden malware.