Key reason for this, as explained by Symantec analyst Dan Bleaken:
The attraction of knowing that legitimate sites often come fully furnished with regular users and a good level of traffic in general, providing a ready pool of instant victims and eliminating the need to stimulate from scratch a flow of visitors to a newly established domain.
Another key stat: Only 6.9% of compromised malicious sites had their infection removed within 7 days. Yes, 6.9%...meaning that 93% of these sites are online longer than a week.
You can find the full report at the URL below.
http://downloads.messagelabs.com/dotcom/Whitepaper_web_threats_2010_EMEA_UK_June10.pdf