[burnerthrow008]

Your link says that Apple revoked the certificate used to sign the malware by the time the story was published.

[jorams]

After a different company detected it, figured out what it did, and reported it to Apple. The app was notarized on November 17, screenshots in the researchers' post are from December 16. That's a month of fully notarized distribution.