Seems that in fact even though scripts aren't signed, IF YOU DONT have devTooling enabled for a given terminal, scripts are hashed and checked against bad known digests.
not a big deal, assuming no data is kept.
Also I wonder what it looks like if a script is deemed bad...
If you're compiling something yourself, the compiler won't put a quarantine bit on it and it will execute fine. Same with homebrew/friends.
Scripts don't need to be signed. There is something else going on here.