Signing does help! Apple can revoke the certificate the instant the malware is discovered, blocking all future installs. Whereas Handbrake is going to rely on X

Signing does help! Apple can revoke the certificate the instant the malware is discovered, blocking all future installs. Whereas Handbrake is going to rely on XProtect[1] which entails Apple refreshing all Macs in the universe at some delay. While I'm at it, distributing through the Mac App Store would have added further protection against this attack on a couple levels. 1) It's harder to compromise with a MITM attack in the first place. 2) macOS wouldn't install an update signed by another party like this. [1] "We have been informed that the process to update the definitions for OSX's XProtect feature started this morning, so this should start rolling out to machines automatically soon if not already."