A problem exists with the security proof in the secure AND example in the malicious model
If I understand correctly, you consider an adversary $\mathcal A$ corrupting $P_2$ in the real world, and which ignores $P_2$'s input $y$ and just outputs $0$ regardless of the value $x$ sent by $P_1$, is that right? And you claim that this adversary is not simulatable.

Well, of course this adversary is simulatable: the simulator sends whatever to the trusted party, receives whatever, and outputs $0$.

The proof, by the way, shows more: it shows how to construct a simulator for any adversary, as follows. In the real world, the adversary receives $x$, performs whatever computation based on $x$, $y$, and its auxiliary output $z$, and outputs the result. The simulator sends $1$ to the trusted party, receives $x$, performs the same computation as the real-world adversary, and outputs its result.