Since the whole point of notarization is to give Apple the power to revoke malicious binaries on its system after-the-fact, this seems like it works by design, no? Apple quickly revoked the notarization once they were alerted of the malware.

Otherwise Apple would have to scan every single binary submitted for notarization, which then puts a pretty large onus on them should anything slip through.