Apple still requires notarization and thus checks for viruses for non-app store apps.

The notarization process also filters out apps that give users greater control of their hardware, because they might touch things like private APIs. When the user goes to run the software they chose to download, macOS will treat it as if it's radioactive, giving the user the impression that the application either doesn't work or is malicious.

The end result is that users are left being unable to use their computers in ways that Apple doesn't like.

The notarization process does not scan for the use of private APIs. That only happens if you submit an app to App Store.

From the macOS Mojave for Users, Administrators, and Developers book:

> The Notary service will also perform some additional checks on the application. These include security checks that verify the application is doing what it indicates as well as the check for private API usage, similar to Mac App Store apps.

[1] https://www.waynedixon.com/2019/05/16/new-notarization-requi...

Notarization does not stop you from using private APIs. Source: have notarized multiple applications that link against them.

From the documentation.

https://developer.apple.com/documentation/xcode/notarizing_m...

> For example, if a plug-in employs deep integration with the host executable via C function pointer overrides, or uses a JavaScript engine for custom workflows, the host executable must declare the Allow Unsigned Executable Memory Entitlement or Allow Execution of JIT-compiled Code Entitlement, respectively. In some cases, a plug-in fails to even load if the host executable lacks the proper entitlement.

This is the best documentation I could find with a quick Google search. But basically, if you can use C function pointers, you can call anything you want and there is no way that an automated scan can detect it with the right level of indirection.

I also couldn’t find anything from the official documentation about not being able to code sign anything that uses private APIs.

But even simpler for apps that don’t actually get manually reviewed, it’s really easy to bypass.

https://medium.com/swlh/calling-ios-and-macos-hidden-api-in-...

Even if they did do something like scan for text strings in PerformSelector, that’s also easy to obfuscate.

Right, so that is OP's point. Either you trust Apple to do notorization, or you disable signature checks by turning off Gatekeeper.

(Or you let specific apps through Gatekeeper, or you go even further and turn off SIP... there are a lot of in-between states, but they fall somewhere on the spectrum between "trust Apple" and "don't verify trust". There's no "trust Mozilla" option.)