The signature can be revoked. Apple does ocsp to make sure that things are still valid. If the malware is bad enough for Apple to notice, then they'd revoke the signature. Sure, plenty of scummy stuff makes it under the radar, but if it were ransomware, hopefully Apple would respond quickly to that.