Incentives. If valve did this, the expectation would be for them to cover any and all future breaches. They don’t have the capability of doing so, and this would incentivise a wave of new malicious programs. Because hey, if you get one into the store, you can now steal a million bucks from your own sockpuppet account, and valve will cover it.