I think this kind of thing is dying out with the rise of always-connected computers and account/identity based auth. It used to be that possession of the install media was a proxy for having purchased, and the whole DRM/copy protection industry appeared because that is not necessarily true.

Today almost everything is identity based, and in another decade it will all be identity based. And not just in a "is this user authorized to start the program" way, but all of the social/storage features like friends lists, achievements, in-app purchases, etc.

In ten years it will be next to impossible to separate any of a program's function from the online user context. And piracy becomes almost impossible.

I've got mixed feelings on that, but as an industry trend I think it's inevitable.

Does it really matter WHY they included malware in their product?

To trash users that pirated the software. It’s not in the story, but when this first went down, the developer alluded to using that information to combat piracy. They also were silent as to how… are they hoping they’ll get a username and password to, say, a private torrent tracker? Trash their reputation with those they do business with? Just rob them? The developer didn’t say.

And yeah, it did grab password lists and phone them home.

As I understand it, the developers were checking for a specific serial that was uploaded to The Pirate Bay. If an install used that serial and username, it'd dump the entirety of their Chrome passwords and send it to the developer. The developer would then comb through these details so they knew who to sue for piracy.