This was the pesky symlink that caused signed and notarised mac apps to be marked as potential malware by macOS after being downloaded from the web.