Edit 1: See @Ori's great answer for how Microsoft has signed a bundle of these executables. I am leaving this answer here because I believe that my argument as to whey the files are not individually signed with Authenticode (what VirusTotal reports on) is still valid. End addition
I could not find an official Microsoft answer, but I have a theory as to why this program (and others like it) are not directly signed.
I have checked several of my computers and VMs and found that this file is not Authenticode signed, at least not in anyway that I recognize. I do have several different versions of this file (going back 8 years). Clean copies of Windows 10 (different builds) have different versions and time stamps so it appears that Microsoft does update this file.
Ok, so why would Microsoft not sign this file? I think that the answer is found in rundll32.exe's purpose. Rundll32.exe is used to run dlls that have functionality that is needed but do not have exes to run them. You can see some examples in this How To Geek article.
Authenticode signatures enforce identity, determine what appears in a UAC prompt and help ensure that a file is not tampered with. If a dll that is a part of a process requests elevation the signature of the exe is used for the UAC prompt as that is the process that is running, not the dll.
Now for some guess work as to why the file is not signed. Because rundll32.exe executes unknown 3rd party code as part of its purpose a signature would be bad for security. Usermode level code can request that rundll32.exe run their dll. If a dll requested elevation the popup would show rundll32.exe, that is signed and verified by Microsoft, asking for Admin permissions. This would make people far more likely to say yes then if an unknown author program asks for permission, which is its current behavior. Because Microsoft cannot reasonably guarantee the function or safety of the code that rundll32.exe runs it would be dangerous for them to sign it directly.
Edit 1: @Ori has figured out how Windows validates these files. This last paragraph is here only for history. End addition
Now this does not mean that the Windows operating system does not validate run32dll.exe. It could (more guess work) compare the file's hash to determine if something has tampered with it. And then execute it only if it is a valid file.