In my experience the quarantine flag gets added if the file is downloaded via browser, chat program, email, or some other way that isn’t curl/wget/other CLI tool. At least for the past 6-8 months this has been my experience. Not that it excuses anything, but for what I have had to deal with it’s been somewhat helpful.
Usually the hurdle is just a pop-up informing you that it's been downloaded from the Internet. Sometimes the malware checks go wrong though and try to prevent you from opening it at all.
