The best place to put malware is wherever people don't think they need to be suspicious of the software they run. Free games, paid games, supply chain - it doesn't really matter so long as they think they can trust it blindly.