What's to stop me from doing this right now? "Here's a free app for you, click here, this link is only for you." It's not only for you, of course, but who checks to see if the URL has a real unique ID in it? (You could always add a "?gift-code=293874" at the end of the URL anyway, the server will probably just ignore it.)
Many people proceed on the assumption that the sticker price on front of an item defines its value. If you price a widget at $199, they may look around to see if they can find it for $189 at a competitor's store, but they don't say to themselves, "hey, wait a minute, given the likely bill of materials, shouldn't this sell for $30?" They take it on trust that price reflects value, to a first approximation.
(Incidentally, this is a major problem facing the adoption of free software, because it works in reverse: "if it's free, doesn't that mean it's not worth anything? So why should I bother with it?" We know what's wrong with this argument, but many non-geeks don't.)
If you want to social-engineer an exploit, I'd say making it look as if the trojan is valuable is going to help more than making it look as if the trojan is free because of the psychologial association between cost and desirability.
(Hence all those "Your computer is at risk, buy our virus scanner now!" scams cluttering up your clueless cousin's web browser.)
If you're a serious criminal and you've found a way to empty someone's bank account via their iphone, I'd say it was worth paying $10 per victim to get a better supply of victims by convincing them that your malware client is valuable and worth installing. Right?
