OSX allows the user to choose from 3 options which impact the strength of the OSX Gatekeeper
- Allow installation of only apps from the Apple store
- Allow only from Apple Store and identified developers
The default is 1, which would have protected the user in this case as the software had to be installed from a 3rd party web site. If you stick with the default, your less likely to get malware (but there are no guarantees, just lower risk).
When you select 2. Your saying I will trust the Apple store and other developers I trust. The trust for these 3rd party developers is based on their software being signed with a valid certificate. The problem here is that nobody ever bothers to verify that the certificate is not only valid, but it is the certificate used by the developers. In the current case, the malware was distributed with a valid certificate, but the certificate was one stolen from another developer. To some extent, it shows the weakness of the certificate system - if developers do not protect their certificates sufficiently, then you are at risk. However, I suspect that if someone was really diligent and actually looked at the certificate and verified it was for the developers who release the software, they would have found it was for some other developer and a red flag would be raised.
The 3rd option basically says your not interested in Apple's view of who can and cannot be trusted and you will make up your own mind and install what software you want. You are also saying that you accept all the risk and it is all your responsibility.
Is all of this good enough? Possibly not. Is the Apple store 100% safe? No, there have been instances of malware in the store. Can there be a 100% safe solution - I don't think so and anything which claimed to be is either being dishonest or it would provide a system which was so locked down and inflexible, people would likely refuse to use it.
Can apple do better? Possibly, but we probably need to be careful what we wish for. Essentially, we have a play-off between freedom and security. All too often, people will emphasise freedom and flexibility and ignore security. They will choose option 3 to install that new free game and then blame Apple when their data is encrypted with Malware.
Most vendors, including Apple, can probably improve their security model (actually, many vendors are really really bad - IoT, Modem and mobile phone vendors etc.) There are also some real problems with the current certificate model, but thats a hole other story. As far as vendors go, I think Apple is better than most and I don't believe the recent ransomeware is a sign that the Apple security model is broken - user on the other hand......