The key here is that Apple can also remove and retroactively revoke signatures on signed applications, which is why you rarely see Mac malware stick around afte

The key here is that Apple can also remove and retroactively revoke signatures on signed applications, which is why you rarely see Mac malware stick around after it makes the headlines these days. When a piece of (signed) malware becomes even moderately sucesful, Apple shuts down all its installation vectors by banning every dev account that's ever signed it. If nothing else this makes it harder to develop malware that spreads rapidly through the App store, forcing bad actors to invest a lot more work into finding 0-days.