Defender Alerts - unwanted software

Hi, i have a question about defender alerts

We suspect that some "unwanted software" alerts are older programs that have been in the folders for some time and are only discovered at a later time.

Is there a characteristic how old such files are?

Are all files already on the notebook scanned, or is a folder/software only scanned when it is accessed?

Attached is a screenshot of an alert where we assume that the .exe has been in this folder for some time but is only now being detected.

(Example attached)