> Windows and macOS these days have vendor-provided code signing authorities that can be leveraged (and are by default), which provides at least some protection against malware at the macro level

The code-signing is relatively trivial to workaround, you just have to get users to run xattr(1) to remove quarantine status.