I need to reinstall WP from scratch due to malware.
Can reliably use the built-in Import/Export tool (Tools > Import/Export)?
It appears it only gives me an XML file. What can I do to ensure all media is also available for import?
In addition, you can import attachment by checking the "Download and import file attachments" option.
(source)
This means, if you use the official WordPress Importer plugin, it will read the media URL from the file, download that file and finally upload it to your new install.
When your old site is offline, eg. taken offline after malware infection, you won't be able to import any media files this way.
If you have backups, you can try to play that in (media related db tables + wp-content/uploads/ folder). But you'll need to take very close looks, as not to back up the previous infection as well.