Probably because .scr is not meant to be run directly, but malware regularly does that.