Do I remember Apple updating XProtect to remove a Zoom component that allowed attackers to potentially hijack users' webcams? I do. Zoom had installed a hidden web server on users' computers that was (a) exploitable and (b) not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack.

Zoom worked with Apple and updated the app hours later.

You can kill XProtect if you want by disabling System Integrity Protection and modifying the malware signature file.