I don't understand your suggestion that Google should have waited to protect their users from a site that is serving malware. Why would that be a good idea?