that's bizarre! for me in both chrome (logged out), and firefox (logged in to a different itch account), i was able to download the file without any warnings. if you happen to have a screenshot of the itch warning i would be interested in what it looks like.
i also get the normal "Windows protected your PC" popup with either download, i'm not sure if that's what you mean by windows flagging it as malicious. i usually expect this popup with any unknown software, and thankfully it's pretty easy to bypass (just two clicks).
ultimately i guess i need to figure out how i want to make this build available on web. some users will not trust the download even if they are able to access it, and some users straight-up cannot download software.