Yeah, that's the tricky part—good intentions don't matter if the file itself is compromised. (Btw, check my pinned post if you'd like to support my family in Gaza 🙏)

Well then you’re fucked lol.

That can happen from a signed one, too, tho. The dev doesn't always know that their code base is infected and can transmit malicious code unwittingly.