I’d hypothesize they maintain some kind of whitelist for sites that have links to executables (or provides executable downloads) because these days it’s quite common to see malware sites with random letters in the URL serve you some random .exe file in an attempt to infect your computer.
Perhaps if you can show some screenshot as to how the antivirus displays the warning, that might give us some more insights.
