XProtect removes malware, not certificates

what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.