I'm sure malicious people are very grateful that this platitude is in circulation.
Calling it a platitude is selling it short. Yes, it's a little strained in the context of people trying to deceive you, but the malicious are still vastly outnumbered by the incompetent.
In general, I agree that most bad things happen by accident, but I think generally it's an unhelpful statement. You should be slightly more suspicious of someone claiming innocence when they clearly experience benefits from the consequences of their actions.
Windows checks the signature.
My point was that without in insider there's probably 50 easier ways to drop malware than infiltrate the software supply chains that I've personally been a part of.