Well, there are some suspicious things about the report itself, too.
They start with 5000 URLs, but only 1188 URLs "passed our post-validation process and are included in the results". This is certainly an opportunity to add bias. IMO, an honest report should be as transparent as possible when showing their inputs, because selecting your inputs to a test has a huge effect on the test itself. I'm not sure why they had to prune the URLs at all, to be honest. (They mention that it gets pruned if it becomes unavailable which is fine I guess, but there were other reasons they pruned as well.)
Also, it would have been nice to include the actual list of URLs used. They do mention they saved the content of the pages, so hopefully if anyone were to audit them those would be available.
The next suspicious thing are the results themselves. When I go look at CPU benchmarks I expect numbers like "CPU A trails CPU B and only gets 90% of the speed" when we're talking about fairly competitive products. (Actually with CPUs I usually expect much closer numbers than that, but whatever.) To get numbers like 99.9% for IE9 (Malware URL Response Histogram) and 12.7% for the next highest product... well, that makes me wonder. The gap is just suspiciously large. It looks to me like either they're specifically testing a feature that IE9 has that other products don't, they've massaged the inputs, or they've gimped the competition in some way. At least, that's what I immediately start thinking when I read numbers like that.
Additionally, they only seem to be measuring the rate at which bad URLs get blocked (you can figure out the False Accept Rate - FAR from this), and that's an incomplete story. We also need to know how often the browsers block something that they shouldn't have (False Reject Rate - FRR). To take an extreme example of why we need to know that, imagine an algorithm that just blocks everything. You'll get 100% malicious URLs blocked and have a 0% False Accept Rate. However, that's obviously wrong... you'll also have a 100% False Reject Rate. All they say about this is "Periodically, clean URLs were run through the system to verify that the browsers were not over-blocking".