Comment by Spivak

The binary you get from your upstream repositories are signed but they aren't verified after that. On macOS if you download vagrant and grant it the ability to read your project directory I can't overwrite or modify your binary without it tripping the system and losing those privileges.