True... and even IF it launches the system's installer, the user has to click "continue" THREE separate times to install the malware, ignoring the system's warnings. And it still DOES put up the warning that the Trojan's signature was found in the Pkg file. . . and that even that doesn't happen if the "Open 'safe' files after downloading" is unchecked in preferences in Safari... because nothing gets opened.
There you go...3 clicks means it doesn’t count! What if the malware writer gets it down to 2 or 1 clicks...does that malware count now?
I just think everyone should take apples advice and install a 3rd party AV product on their machines. Or are you suggesting Apple is wrong when they suggest 3rd party AV?