You can always make the "err on the safe side" argument for security related practice. But at least provide transparent and responsive communication channels for legitimate authors to dispute a flagging. Right now the whole malware detection thing is a blackbox that makes software authors feel powerless. I can only imagine AI products making this even worse.