Not strictly true. I regularly test push notifications on sideloaded builds at client sites. Getting provisioning profiles and certificates setup correctly (especially on all extensions) is a bit cumbersome. To get those certificates may require an Apple enterprise developer account. And the builds signed this way are not debuggable.
I'm not certain but I think push notifications can also be used "invisibly" to trigger data sync so this could mean limited functionality beyond just receiving "pop-ups".