Bad example because that .pkg was probably signed with a developer certificate with approval from Apple - just as would be the case on Android in the future.