Or they could bundle a basic driver or police the driver they're curating while allowing people to download and install drivers directly from the vendor website with no policing, no signature checks, etc.

Distributing malware is negligent or malicious, yes. Not stopping users from seeking out their own malware is neither. Nothing stops you from running malware on Linux. The curated repos are simply good enough that there's not much reason to go looking elsewhere.