To answer questions:
1. I do not know Nortons program but there should be a setting to disable that. If not, please ask Norton support.
2. It is usually not possible to determine if the hosts file was written by a good program or some scammer, so an alert would trigger all the same. Second, you cant just write the hosts file, you need a bit of tweaking. So a program looking for changes might have the old file in memory but will not be aware of a change until restart. This makes such an alert difficult to handle.