"If an app is found to be malware, Apple can revoke that developer’s certificate, rendering the app (along with any others from the same developer) inert on any Mac where it’s been installed. "

Yeah, it's not a great reach to think that in five years there will be no Option 3 and malware will include any program that the government of the nation that your computer is in deems undesirable. Apple and Microsoft will likely be forced to have such capabilities by various national governments.