The part you're missing is that they won't be in practice. There's malware on virustotal with (still) valid code-signing certs.