That was kind of my question, whether it was restricted to downloading notarized apps (which is at least something) or whether they were circumventing that somehow.

Locally compiled code doesn't need to be notarized, if that's what you're asking. Or a dose of xattr -d.