These sites that are serving exotic malware and are taken over by feds. Is it the feds serving this malware, or is it happening despite the feds having taken over them?

Both, for different reasons.

I don't have a source yet for the second, but fingerprinting is powerful, and if you look like a cop criminals do all sorts of things...