Why should the NYTimes have to spend their resources and lose their revenue to educate and support people removing that software? That's an expensive cat and mouse game that they shouldn't be forced to play.
Better that they should have to spend the same money in additional taxes to support government investigations and prosecutions, only to have the bad guys move offshore and keep at it?
I think you're perhaps overestimating the cost of banning such things too. For one thing, there is no reason to go it alone. Major ad networks should be providing websites with tools to identify and disinfect affected clients. Then the cost to the NY Times et al would be little more than installing the supplied tools on their servers.
In addition, there is a certain amount of "starve them and they die" that needs to happen here. If something is illegal but still profitable, it continues to happen. On the other hand, if it becomes unprofitable because no websites will service infected clients then it disappears even if it's still legal.
The cost isn't in implementing the detection or writing a nice notice, it's in supporting the people it's for. Removal can be hard, look at Sony's bs with rootkits the other year.
Aside from that websites are a terrible way to fix a problem, there's probably still a massive amount of the internet 'best viewed in X' even though standards and non-IE browsers have been popularized for years. It's taken like a decade of campaigning, education and updates to reduce IE6 to insignificance.
Browser / operating system vendors are in a good position to tackle it and there's precedence for that too, but a single website even as big as the NYTimes is in a weak position to do anything except sue.
You don't literally have to have every website on board. You just need a critical mass such that any given malware-infected user will encounter a website that they consider important but that they can't access, and therefore have an incentive to take steps to remove the malware. That goes a long way to deprive the malware authors of infected users, even if there continue to be some websites that don't block the malware.
And as for browser and OS vendors, it seems like there is a clear way for the Times to push that along: If this problem is nontrivially impacting ad revenue then Google has a clear incentive to work with them on Chrome and Android, and with that as leverage, they can go to other browser and OS vendors and say "take the same measures to keep your users from coming to our website infected with this crap or we'll be recommending that they use Google's products instead."
