[jeromegv]

This setting in Preference Panel is opt-in, not opt-out. Default behaviour does not reject non-MAS apps. Most likely a security setting for companies or restricted environments.

The rest is pure speculation.

[15155]

Which part was speculation?

The SIP setting is most certainly "opt-out." Have you demoed El Capitan?

The Preferences -> Security -> Allow non-MAS/non-signed apps setting is most certainly "opt-out" on any machine you buy from Apple or at the store.

Prefacing something with "I suspect" generally allows one to speculate.

The trend is that you're gradually losing control of your machine.