but how does the browser interpret a hidden window like the one shown? maybe it even sends out that the page is in view... and even if not... how long until the malware coerce it to say so?

and you are the only one here in the right track. the ad ecosystem IS moving to a bill per viewability model. though for the wrong reasons (drive advertiser expending down, like they did artificially with paying for click instead of display)