A possible solution would be to distribute the client through something like the Windows Store on Windows, and a URL connection handler. The support-receiving website (or intranet support page) could work by opening a URL like remote-support://internal.domain.eu/listen from a web page and if that fails, link to the Windows Store and install directions instead. An unsigned, backup download of unsigned executables can be added to that download page if you so desire.
Theoretically, you could also set up some kind of DHT or TOR-like network where nodes can just find each other. You wouldn't want to send standard Bittorrent or TOR traffic without warning in corporate networks, of course, but the technology exists.
For businesses, the unsigned executable with config could just be distributed by the IT department with their own certificate or the necessary exemptions, and launch an autoconnect daemon, if necessary.
The _real_ challenge, I think, for building such a tool is that if it works well, scammers will use it and slander your product. Some might even patch out any warnings or alerts that you add to protect innocent people from scams. Scammers aren't intelligent enough to make their own RAT, but just one tech-savvy criminal could make loads of money with some slight modifications.
There's more nuance here which OP is alluding to. If you form a corporation and get an EV cert, you will not get a SmartScreen block, not even on your very first download. Immediate SmartScreen reputation is the point of getting an EV cert for this; Microsoft says this explicitly. If you get an OV cert (the only kind that an individual developer can get!), you will get blocked and will have to build reputation.
As an individual open source developer, I have an OV signing cert :( At least it shows my name on the SmartScreen prompt.
I’ve never done it myself but there was a posting here about 8 years ago about how Dropbox distributed their installer and I took a quick look at it: https://news.ycombinator.com/item?id=8204454
All the rest seem to copy the terrible design of on demand code signing and that doesn’t work. If you get an EV certificate for instant SmartScreen reputation the key is on a HSM. If you get an OV certificate that is easier to automate with you need to build SmartScreen reputation which is brutal.
The RuskDesk project mentioned below was the most interesting to me. It’s a small executable and works pretty good. That’s enough to tell me that someone should be able to build a great product if they have instant support executables signed with an EV certificate.
What it comes down to though is that everyone needs their own code signing certificate or someone needs to run a matchmaking service. I’m sure you could build something that works well with Cloudflare Workers/KV by sending hashed (+salted) IDs to a matchmaking Worker. When a customer reads me the ID I know the secret and can tell the matchmaker “here’s the secret, please redirect the client to my self hosted server, relay, etc. at support.example.com.”
Also, Screego is another interesting project to check out.