Couldn't an attacker cause online (watch-only) wallets to display malicious receiving addresses?
Yes, this is possible. However, since Bob (actually, in cryptography, usually Eve, the attacker) has, apparently, got access to Alice's computer, he/she could also replace the Bitcoin application with one that does the same thing.

The purpose of this procedure is to protect Alice's existing bitcoin. It does not do other things.