If you believe in that as a security measure, you could still have a signing requirement and apple could revoke trust on known-bad binaries. Which is probably what they will do.
If the developer needs to use Apple resources to track and manage said entitlements, and the consumer expects Apple to police bad actors, then are we asking Apple to do this for free on the bad actor’s behalf (oops, I didn’t mean to use your microphone, GPS, BLE in order to sell the info to an enemy state, law enforcement, angry ex!) or should the cost of said infrastructure be passed to the customer when purchasing hardware? OR does Apple wait until an application is exposed, generally through an echo chamber after the damage is done and is made aware of the issue?