I assume that Apple's reasoning is "Userspace malware shouldn't be able to trivially intercept anti-malware checksum updates". Trivially is defined as 'click a

I assume that Apple's reasoning is "Userspace malware shouldn't be able to trivially intercept anti-malware checksum updates". Trivially is defined as 'click an OK button in a dialog' as the CF permissions process works in Big Sur today. Malware could still block anti-malware checksum updates with PF, but that requires sudo/root which is 'less easy' than the one-click CF approval process, and PF blocks break so many things on the system that malware can't get away with it without triggering a call to technical support. (I personally think that much of the issue here is 'macOS background updates can cause $$$$ cellular data drain over wifi-tethered cellular', and that the absence of Low Bandwidth mode in Control Center is one thing that drives users towards these third-party content filters, when they might otherwise not need a third-party product at all.)