[yoz-y]

That is the case. The defaults are 'developers who were vetted by apple', it is up to the user to trust or distrust individual applications and running non-signed ones is trivial.