Compromising TLS is an infection vector. People regularly download programs from trusted websites and run them. Some apps automatically download updates from the vendor's site via TLS.

AV scanners do not have a 100% detection rate. Letting malware be where a trusted program is expected is how you get infected.