Or they could bundle a basic driver or police the driver they're curating while allowing people to download and install drivers directly from the vendor website with no policing, no signature checks, etc.

Distributing malware is negligent or malicious, yes. Not stopping users from seeking out their own malware is neither. Nothing stops you from running malware on Linux. The curated repos are simply good enough that there's not much reason to go looking elsewhere.

That is really what everyone else does. When you get the auto downloaded Nvidia driver you get only the bare basics and it's not bugging you to install the GeForce experience stuff like they do if you download it from their website.