cybmole, Windows does that because the binaries are not "trusted". It has nothing to do with being non-Microsoft software. Anybody can sign an exe or msi for the price of buying a certificate. See
here. That doesn't mean it's worthwhile for calibre to do, and it doesn't really matter. It only affects the msi. Once installed, calibre runs without warnings at all.
Of course I'm sure Kovid would be quite happy to sign each msi if you or someone else ponied up the
$300/year it takes to get a certificate.