It is necessary to at least disable the ability to create self-moderated topics for beginners and users without reputation. It is not difficult to do, but there are many benefits. Scammers are currently removing malware warnings from their threads. Additionally, you cannot add a warning flag for self-moderated topics. The moderator is not always available and takes time to consider the complaint. Thus, the scammer has a greater chance that his virus will be downloaded by inexperienced users if there is no way to warn them in the comments, because the scammer has the ability to delete such comments.
That has been suggested several times, but the admin has considered not to be too strict on newbies since some of them are genuine. This will lead to a natural death of the forum.
About posting malware, as soon as you see any user post that, just report it to the mods or post it in a dedicated thread in meta. The mods will immediately ban the user. They have zero tolerance on malware. What they don't moderate is scam.