The bug isn't in mac OS's signature validation though, which works fine. The bug lies in the additional validation performed by certain third-party security pro

The bug isn't in mac OS's signature validation though, which works fine. The bug lies in the additional validation performed by certain third-party security products. It has nothing to do with any of Apple's code whatsoever. Although as another commenter has pointed out, Apple could maybe have designed the API better to avoid it being used wrongly.