That's correct. AFAIK Catalina will check online for everything, even binaries you compile yourself.
https://medium.com/sensorfu/how-my-application-ran-away-and-...
It almost certainly is, but
1. You have to know it's happening before you can do anything about it
2. If your "work" isn't registered with the copyright office, you're limited to actual damages, which are probably close to $0
You can like that behavior or find it unacceptable, but the issue in OP is not that, it was applying to executables that had already been launched plenty of times on the machine.