It wouldn't surprise me if there was a significant criminal organization embedded within Microsoft's org chart supporting these things. In the past I used Microsoft's customer support chat through their website which then gave me a number to call back. That number appeared to be a legitimate number for Microsoft. They then requested I install a remote assistant tool from a non-Microsoft domain which they said may cause my screen to go black for several minutes. Stupidly, I went along with this before realizing what was going on.
The whole software signing certificate industry is broken and won't save anyone from hackers. What's the point of certificate when "verification" is just bureaucratic process which does not verify anything, especially if you are not from anglophone country. How does certificate provider want to verify that company in Eastern Europe exists? By some scanned piece of paper which they don't understand because it is written in language they never heard of and robocall which is just sequence of numbers? If you want a certificate for signing, you will get it.