And it has been wildly successful because it allows people to make and distribute applications without an army of volunteer packagers or forcing the user to compile from source. It wouldn't be a problem at all if Desktops had gotten around to the idea of sandboxing everything by default the way mobile did.

Not really. When I'm downloading Firefox, it's digitally signed by Mozilla. When I'm downloading VLC, it's digitally signed by the VideoLAN foundation.

I actually don't think I have a single piece of non-signed executable on my Windows PC.

And what is exactly the difference between "downloading a random executable from the Internet" and "downloading a random digitally signed with a random signature executable from the Internet"?

Either the author is random or it is not, and the signature is not really going to discriminate much in this area...

The difference is that someone paid one of the two billion CAs which can issue Authenticode certs about a hundred bucks.

not quite "two billion" lol and the cheapest I know of is Digicert. You're looking at $499/year or$699/year for the extended validation cert (this is a higher quality cert that passes more security checks.) What is this validation you ask? All kinds of identity verification on the business and it's owner to ensure they are who they say they are and they are located where they say they are. The idea is that bad actors aren't willing to pay $$$ annually for any reason much less to expose their identity. Lockdown uses the EV cert.

that's ok, lockdown.exe is digitally signed

99% of the time it works all the time!