[sneak]

There are certain apps (like Wireguard) that Apple will not notarize for non-App Store distribution.

Basically, for certain classes of apps, macOS is now already taking the iOS "App Store or gtfo" model.