In practice the USG would not distribute malevolent binaries everywhere, but could target them to particular IP- and time-ranges.

Downloading Tor from a particular IP in Iran? We'll add a little something extra...

Or maybe you're a US citizen with a set of known IPs on a "watchlist".