Comment by Plasmoid2000ad

Lot's of enterprises are enabling whitelisting of apps launching using some sort of tooling - I think Microsoft provides one, and CrowdStrike etc. It's likely the delay involves a call to a backend application or even sometimes a web server. This would be on top of real-time scanning of every file before it's opened.