It can be, but the certificate would be quickly revoked and signing ones aren't exactly cheap. Also app store does a little bit of app checking I'd say.

you say that like that makes it not worth doing

Or that perfectly legitimate software can't be used in nefarious ways. Teamviewer, for example.