[mothered]

But the VT report is of the archive, which is kind of pointless.

This ^

Not only does a virus scan fail to "dedicately" scan the executable Itself, but the archive can contain an array of files- perhaps not relevant to the contribution. I'm not suggesting It's the case here, but rather stating a fact.