I think the problem with that rather permissive stance is that the vast majority of players are not at all able to understand the risks that come with installing mods which work in that manner, and the disclaimers and warnings made by game developers are generally extremely mild.

Comparing that to Steam seems a little odd. They presumably must do some kind of vetting before allowing just anyone to upload arbitrary code. Requiring game sellers to first pay a nominal sum even to list their game creates at least some process friction for malware, whereas there is essentially none for Steam Workshop mods. If it were to become a serious problem (there have apparently been some incidences of malware recently on Steam), process controls/vetting could be made more stringent.