I think is appropriate to have such questions. You address malware itself often by reversing it. I would imagine some question would not be appropriate not because of what they ask, but because they would be better maybe on stack overflow or on crypto, if they get that technical. There are plenty of tutorials on how to work with IDA, overflow the stack, write brute forcing algorithms, etc.
By not allowing this topics, that is buying in to security through obscurity. By making this information more difficult to find or trapped in niche books not available online, we are not increasing anyone's safety. If anything, I would imagine that governments could always trace a script kiddie's efforts back here, and work with SE to get the IP information and bust someone who goes super evil black hat.
If it's a good question, with detail on a specific issue or technique asking to accomplish some specific goal, it is most likely a good fit and should be addressed.