Apple has revoked the dev certificates to stop further infection: https://www.macrumors.com/2021/02/22/apple-revokes-silver-sp...
I also just learned that you can see when the last update was with the following command:
```
system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData"
```
And then any updates are added to `/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara` (for macOS 11, at least).
[1] https://support.apple.com/guide/security/protecting-against-...