Instead of just the deleting the file, the default action for malware downloads should show a dialog box where the only possible action is to delete the file. This gives the opportunity to explain what happened in more detail. This dialog box should contain a sentence to help users discover the ability to unblock the file from the context menu. This is because, at least initially, we won't have an additional "Learn More" link in the dialog or in the download item.

Until we can expire malware downloads on which no action was taken, the deletion from the file system is the sensible and safer default action to offer for malware, at the expense of clarity of explanation.