No, they installed an update to XProtect's signatures to say "this is malware, remove it if detected" -- something the company has done many times in the past.