[zepto]

I’d say this is only one half.

Many malicious effects involve social engineering, fraud, etc, and are not about exfiltration of files.

[api]

In that case code signing can’t do much either.

[zepto]

On the contrary code signing is the only current solution to this problem.

It allows fraudulent, malicious, or easily exploited code to be disabled.

[api]

How can revoking apps stop a phishing attack?

[zepto]

Easy: Revoke the certificate of the app doing the phishing.

[judge2020]

To add, this is exactly what google's safe browsing is https://safebrowsing.google.com/