This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere).
Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
False detection is a nightmare in the corporate world and this IT worker bashes his head every time he runs across it.
Nirsoft tools? Bam, "virus" and "malware". How dare you!
Tailscale website? Uh-oh, ZScaler thinks that's a "remote access tool" so you're being given a click-through formal warning!
The Framework website? Uh-oh, .work is a bad TLD! Can't browse to that, it could be evil!
But the main characteristic of malware is that it works for someone other than the user, no? Research software works for the user themselves.