For too long, the conventional wisdom has dictated that users should keep anti-virus up to date, use a firewall and stay away from questionable sites. That is not enough. As the Yahoo-McAfee deal shows, trusted sites are getting compromised and pushing malware. End-point security, like local AV, is necessary but not sufficient; just look at the size and complexity of the Storm botnet. Up to now end users have been paying for poor security and ISPs have been living with the impact of it as well. Now businesses will start to feel the pain. From InformationWeek:

Web sites penalized by McAfee's scarlet letter may see a drop in visitors despite the possibility that the fault may lie with the security of the site's ad syndication network rather than with the hosting site itself. Still, fear of such stigma may make site owners demand better security at ad networks, which would improve Internet safety for everyone.

End users can't be left holding the anti-malware bag. I've argued that ISPs need to do more. Yahoo is making the right move if for no other reason than to keep it's search service viable. At some point, we'll start thinking of a search engine without malware warnings like a client device without AV.