So what are they doing about previously infected computers?
I also just learned that you can see when the last update was with the following command:
```
system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData"
```
And then any updates are added to `/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara` (for macOS 11, at least).
[1] https://support.apple.com/guide/security/protecting-against-...