So now it turns out that:
1. A rootkit (known as XCP) is found on about 50 of their CDs
2. Their uninstaller for this is a bigger security threat.
3. A second self-install software (MediaMax) is far more prevalent
and is "Spyware", in that it phones home.
4. The uninstaller for this is also a security problem.
5. The virus writers are all over this like a rash.
6. None of the anti-virus protection systems considered this a threat.

A summary can be found at: EFF and the whole thing is documented at Freedom to Tinker

An interesting solution has been suggested:

Every time a user plays a XCP-affected CD, the XCP player checks in with Sony's server. As Russinovich explained, usually Sony's server sends back a null response. But with small adjustments on Sony's end -- just changing the output of a single script on a Sony web server -- the XCP player can automatically inform users of the software improperly installed on their hard drives, and of their resulting rights and choices.

But as Bruce Schneier suggests:

This is so obviously the right thing to do. My guess is that it'll never happen.