Or they could bundle a basic driver or police the driver they're curating while allowing people to download and install drivers directly from the vendor website with no policing, no signature checks, etc.
Distributing malware is negligent or malicious, yes. Not stopping users from seeking out their own malware is neither. Nothing stops you from running malware on Linux. The curated repos are simply good enough that there's not much reason to go looking elsewhere.
Well yeah, when you spend a significant segment of your corporate life being both negligent and an evil monopolist, people tend to assume the worst. Don't like it? Behave better.
There are more than the two bad choices for behavior here.
It's not "no matter what they do" it's really that everything they do is wrong and there really are much better alternatives than the choices they continue to make.