If a user has already installed a suspicious garageband 104.dmg :

Once GarageBand 10.4 is installed from the App Store, you can create your own DMG for offline use:

Version 10.4.9, for example, addressed critical vulnerabilities that could allow apps to gain root privileges [1].