It's standard practice when installing things on macos. Although it's typically signed .dmg's