macOS does follow the same model now, in case you haven’t been paying attention. You can’t run unsigned binaries downloaded from the internet anymore.
I ended up having to pay $100/yr for a developer account to be able to sign and notarize the binaries. They can now open them like usual, with just a warning that it was downloaded from the internet. But without the signature they get an uncircumventable gatekeeper error.
ETA: See https://wiki.freepascal.org/Code_Signing_for_macOS#Big_Sur_a...
We use cross-compiling infrastructure on linux/docker for the app I maintain, which don't generate these signatures. This causes the resulting binaries to be rejected on recent apple devices (although they used to work just fine with user override on intel-based macs).
1. Your link gives directions for enabling a setting on M1/2/3 Macs that does allow running unsigned apps from the internet without prompting. (see the heading labeled "Big Sur and later on Apple M1 ARM64 processors").
2. Even without following those steps, I can run unsigned apps (I just have to click through a gatekeeper warning the first time I run it)
3. Requiring technical users to run two terminal commands and adjusting one setting in system preferences one time to globally allow unsigned apps seems like a reasonable trade-off to prevent non-technical users from running malicious programs... like, if I were setting up a Mac for my grandmother, I would never enable this gatekeeper bypass.
Gatekeeper is one of those things that is loud when it gets in your way, but silent if it isn't working... so having it off by default doesn't really make sense. The only way I can see having it off by default is by adding a screen to the onboarding flow that asks a question like "do you plan to submit an app to the App Store in the 12 months?", and then disabling gatekeeper if the user clicks yes.
But regardless of holes and backdoors in the gatekeeper system, the point is that you can't download an unsigned, native binary from the internet and run it on a modern (apple silicon) device with a user override. Not anymore. You have to sign binaries in order for users to be able to override-launch on their own systems. Gatekeeper will stop any unsigned binaries from the internet from being run, full-stop.
And yes, I'm both a user of macOS and an open-source software maintainer. One of my apps has releases built using a cross-compiler on linux, with a reproducible build configuration that was tricky to get setup and hadn't been updated to handle code signing. When M1 devices came out we had to go through the painful process of replicating a lot of the Apple codesign tooling on Linux so that we could apply signatures from within the reproducible build environment, just to enable to the user to right-click override like they used to.
Because while Apple pretend to be operating in good faith, they have been hard at work to make sure nothing they do not approve of can be run on their hardware. No matter what some fools like to think. There is a greedy money related part but it also has a lot to do with dystopian authoritarian views "I know better" that are very common among the boomers currently running Apple.
In french my mother would say that those peoples are "nigauds" (dense/thick) which I find pretty fitting.