That's the real story here. Everything else after that is just icing on the tragedy cake.

Why does this guy need to raise 32 grand (a respectable salary in plenty of places) for cancer treatment

It's cooler when americans become drug dealing kingpins because they got lung cancer.

A password-protected zip file should have been flagged by Steam as suspect before they approved the update, its a very old and very common method for detection bypass.

Considering how the malware works, it seems that the criminal managed to copy/steal all the browser data of Rastaland, including open sessions, allowing him to login on any site that had an active session/cookies, including that pumpdotfun where the coin was

To keep it short there is two big families of wallets. Hot and cold wallet. Hot wallets are the one that got an internet connection wether it's a constant one or periodically connecting. Cold wallets are never connected to the internet and often are dedicated hardware devices with the better ones having a Secure Element to store the private key or even sometimes sign transactions directly in it.

Victims of this attacks were using hot wallet on a not-dedicated machine which is consider bad practice. Hot wallets have to be consider more like a physical wallets for daily spends and cold wallet being privilege for long-term saving and monthly or yearly transactions.

I'm not an expert but desktop OS (especially Windows) are not as well contained than phone so I almost never use hot wallet on my computer. Often users are tricked to sign transactions to get stolen but I think if the wallet is unlocked a malware with the right privileges/permissions could easily steals money.

by reading some file in the computer Aren't Steam games always executable for Windows?

With meme coins, the liquidity is dogshit. There's no real market for sale.

If you sell the tokens piece-by-piece as you get them, you drive down the future price and might get less real money overall. Better to sell a big chunk at once.

Also, not every exchange has a wallet/custody system. It's entirely possible for direct p2p trades to happen without any intermediate transfers. I don't know if pump.fun actually does this.