I didn't mean the boxed software you bought at stores. I meant the software you download as freeware, tryware of even paid on the Internet, for burning DVD, making backups, defragmenting, playing music, playing movies, etc.
Software in Linux distros repos (and the *BSDs) is also a free download and they have a pretty good track record of keeping anything bad out. Given that there is a single point of control, it similar to what Google is doing.
I know someone will claim Android is a bigger target. Well, some Linux distros are also good targets because of the number of corporate systems (especially servers) that malware could get on through them.