The biggest threat I see for bitcoin is fear of losing money. If bitcoin gains any significant traction, you can be sure a huge wave of malware targeting wallet file and exchange websites will follow. Just too easy and profitable for scumbags to pass on this opportunity. Heck, that's even what rogue government could do, no need for massive investment for 51% attacks, regulations or new laws. Typical user is too clueless to keep his computer secure. After wave of successful breaches general population will associate bitcoin with money loss. Even easier, just setup fraudulent web shop and run with people's money. Transaction is irreversible, hard to trace and non-punishable (I think, can you press charges for stealing bitcoin?).
In my eyes, above makes hard for bitcoin to gain bigger significance than micropayment solution, and we need more than that.
Even then, consumers love chargebacks. What good gives 3% price reduce if I have a chance I won't see my shipment ever and couldn't do anything about it? Whole system had to be based on trust, reviews and others feedback, too easy to gamble. Merchants of course hate chargebacks and payment processors and would love to see it go, but in the end they will use what pours them money.
Hope I am wrong.
Unfortunately, your first point is accurate. The sheer number of infected machines is massive. As much as I would like Bitcoin to obtain widespread adoption among the masses, the threat of malware at the moment makes it impossible due to the number of computer illiterate people. While the average user is slowly becoming more security aware, there is still an alarming number of people that will type the same password on every website, provide details to every phishing email, etc.
Of course, the obvious solution to that is Bitcoin Banking, so the responsibility of securing their money is removed from individuals, just like most other currencies. The only problem with Bitcoin Banking is that it starts creating the risk of undermining other selling points of Bitcoin.