But after enough people run it, that disappears. They implement crowdsourced trust, because it isn't a rent extraction exercise but actual concern about malware.

True.

But also most malware delivery now doesn't trigger it because malware developers have gotten craftier. If you're unscrupulous, it's not a concern.