It's 3 clicks if you know how to do it, which they go out of their way to not tell you in the error you get when you try to run it like any other program.

If they told you how to do it, then what would even be the point? The whole idea is to add a stumbling block in the path of malware authors getting users to run a trojan.

Anything the user learns to do by rote without first understanding the security implications provides zero security. Like the Windows Vista elevation prompt — users just learned to hit "Yes" and got infected anyway.

> If they told you how to do it, then what would even be the point?

To warn a user.

And what would be the point of doing that? You have to have some behavioral outcome you expect.

Do you expect people to react by not running the program? Why? If you find out that they are in fact still running the program just as much with the warning in place, because they aren't reading the warning... then have you actually "warned the user"?

Users don't know that, though. macOS treats the app that they want to use like they're radioactive and don't work, and doesn't give them the explicit option of running what they want anyway. They have to know some magic ritual to open it.