Update README with security disclosure re: unofficial dmg