Because it has been out and published and used for weeks/months. The longer an artifact is public and in use, the less chance it has of being malicious.