The problem is that many detection methods rely on heuristics that don't actually determine whether a program is dangerous; instead, they flag patterns common to many viruses while overlooking the fact that legitimate software uses those same patterns.
As I understand it, PyInstaller runs a loading routine to execute the Python code—a process that appears suspicious to various antivirus programs—and rather than verifying whether it is actually a virus, they simply raise an alarm.
The standard procedure is to report the false positive to the companies responsible for the detection (likely Microsoft in this case). They usually conduct a more detailed review, and once they confirm it is a false positive, they add it to a whitelist so that future updates won't flag it as a virus.