[sneak]

There are, as I understand it, certain notarization entitlements for APIs that Apple will only grant for App Store apps, such as VPN apps. This is the first I've heard of functionality being restricted to MAS apps (and prohibited from signed/notarized apps that are downloaded outside of MAS).

I was told this by the WireGuard team when I inquired why the WireGuard macOS VPN app is only available via MAS and not direct download (such as the Windows wg client).

I'm not 100% sure it's true, though, and am testing now. ProtonVPN claims to be working, with packet filtering for non-VPN traffic (kill switch) on 11.x, and they've a direct download, so it's possible that the wg devs are mistaken.

Apple leadership is answering in the implied context of "someone with an Apple ID". I'm never using my Apple ID again on a mac for any reason.