Threat Actors can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.