Why not .pkg (next, next, installer)? For the past week, I've been tweaking my startup's CLI to install as a .pkg, satisfy Apple signing, and everything that goes along with that. I've often wondered why so many companies opt for the icon method.
Of course copied binaries can cause plenty of trouble too, but I have much less of a reason to give an installed program admin privileges than I do an installer.
In our case, the CLI is part of a data sync system, so it does need a "special" once-per-hour check for new data (keeping local and mobile in sync).
I've actually been surprised how strict Apple is before it will happily let signed code run. But the average user (including me previously) doesn't know that. I think trust comes down to being clear up front.
Note to self: Add extra details/options to installer (WYSIWYG)
The MAS version has only one of those and it works.
I prefer this one: https://mothersruin.com/software/SuspiciousPackage/
But I’ve used both at different times with equally great results.
Keep in mind that a package installer becomes obsolete and nonfunctional when the code signing certificate expires, unlike an app.