[zackees]

Malware can change its signature and then it’s no longer on the exclusion list.

However if an inclusion list is used, then the malware changing its signature means that it loses the ability to execute.

[AnthonyMouse]

Except that approval is automatic so they just modify the signature and submit it to be included again.