That is only when it was flagged as malware.

Defender is usually really great at defining malware and has little false positives. So you better watch out if you have to de-quarantine it.