“In the Reddit thread, the owners claim to have posted information about the sale on the website, but that has turned out to be untrue.”
Bartender’s developer sold it two months ago and told nobody. Users found out when MacUpdater flagged a new signing certificate and the app started asking for new permissions. The buyers claimed they had announced the sale, which was false, and still won’t say who they are. An update signed by strangers who lie about disclosure is exactly what malware looks like.