You’re not wrong that it’s overly paranoid but as an example the Cow Girl Vending Machine project I have is necessarily a locally run application.
When initially distributing it, several users were getting notifications from windows that it was being blocked as a known trojan threat by windows defender. I was legitimately concerned that LibGDX, the framework that I rely on, had somehow been compromised.
Apparently this was all a known issue through the construo build system it uses to package EXEs, and in a later version LibGDX actually downgraded the construo version they use just to mitigate these false positives.
Regardless, it was a few days of no sleep for me, worrying that I’d been compromised, the toolchain I use was compromised, and somehow I had been unwittingly spreading malware to friends and customers. (눈_눈)
Web-only distribution where web-only distribution works is less work, and less headache. ┐(￣ヮ￣)┌