Except that it's easier to invalidate an entire signing certificate than to hope your malware definition satisfies all mechanically generated permutations of the malware.
How does that help you when the malware authors can get more signing certificates the same way they got the first one?
Notice that this is easier for malware authors to do than ordinary people because their business is compromising others' machines, so then they can use the signing keys of any victims who have a developer account, or sign up for new ones using stolen cards from any of the victims.
Meanwhile you would then have Apple revoking the victims' signing certificates and screwing their honest users who can now no longer install the non-malicious software they previously released.
The entire premise is a scam to extract an annual fee from a million small developers.
You know what's even easier than getting a signing certificate for malware? Not bothering with signing at all.
And revoking a cert for one "dev" does not mean revoking everything, as for them stealing signing keys from other devs (not typical users, but security literate) how often does that happen, especially in the case of apple with sandboxing etc?
