The app still has to be notarized, this seems logical to me, I’d only be worried if they ever allowed unsigned apps to run. There are plenty of “free Vbucks” and survey sites that show you how to enable sideloading on Android to download said app that is just pure malware.
You can enable unsigned apps, but you'll loose Apple services (e.g. iMessage). This should be enough to convince normal users not to do it, but allow those who really want to do it, to do it.