When trying to download the window zip release, chrome sees it as a virus. If you still download it using firefox for example, windows defender will quarantine the zip, seeing it as a trojan. See image below.

This is a well known problem of embedding the .pck: godotengine/godot#45563
I don't know if there's a solution beside not embedding the .pck or paying for code signing. I just wanted to let you know as it's pretty scary for normal users and also cumbersome as you have to put an exception or disable window defender.