Lua was designed primarily as an embeddable scripting language, and embedding the interpreter as a library is absolutely a valid way to use it :)

My point is about deploying standalone applications.

Tools like srlua, luastatic, and many others, package Lua scripts with the interpreter and required libraries. These bundled executables can sometimes trigger antivirus false positives, just like tools such as py2exe for Python. They use packaging techniques that can resemble those used by malware, which is why I called this approach "hacky".