Has there ever been a known case where a machine acquired spyware like a browser toolbar, or plugin but that spyware also deployed more dangerous malware like a trojan, botnet, or worm?
Yes. What happens is that something gets a foothold on the system, phones home, and then is bootstrapped with a rootkit that is suited to the browser or operating system.
Once compromised, the attacker can deploy different payloads - this month it might be a bitcoin miner, next it could be ad injection into the browser, whatever it is that they are being paid to do.
It doesn't always happen, but I'd say it is pretty common. This leads us to conclude that to be certain your machine is not compromised, always rebuild, no matter how mild the infection might appear to be.