Because of their nefarious purpose, there is no criminal distinction between the writers of malware and those who release malware.

That statement is false.
The person who wrote the malware could have no idea on how the program would be used. (
The releaser of the malware on the other hand, tend to have the full knowledge on which type of information they're intended to take by spreading the malware.
So the punishment of the releaser tends to be significantly higher.

It's considered to be association or connection