It could also be that some ransomware crap has used their codebase as a foundation for their system and then it gets flagged.

It's a very very common problem in the Demoscene, demoscene authors striving to impress in the 64k category created better generic EXE compressors to shrink more content into their 64k binaries, just when any tool is publicly released it is almost immediately flagged by AV software since virus makers scour our forums knowing that once in a while a useful tool comes to hide their malicious code.