Actually an interesting question: will Apple be happy to sign third party app stores and package managers? Including those that, say, sell apps and take a percentage?

They sign literally everything. There is no human review process involved in notarization.

They sign malware?

Pretty sure they do. Part of the point is that they can revoke the signature once it’s found to be malware, and likely the signatures for everything associated with that developer account.

They try not to, but it certainly seems like Notarization is more to be able to disable malware after it's detected than preventing it from being signed at all.

They've probably got enough info from your signup for the developer program to send the FBI to your door afterwards.