The OS would confirm that it was an end user making the action not malware. It is about the automatic creation of security rules based on observed behavior. The other option would be to create everything manually, which doesn't happen.