2. If it seems worthwhile to do so, take the time needed to establish the trustworthiness of the app by verifying where it originated and how it got to you. Then decide whether to run it.
An answer I would like much better: Run it in a VM. But I haven’t tried that on macsOS yet. Hope to soon.