There is a developer mode on macOS to disable that though, you just boot into recovery and do “csrutil disable”. And even without that I can still install binaries I get from outside the App Store as long as the developer self signed them at some point (and the signature lasts for as long as they want). We need that on the iPad at least, and maybe the iPhone, as you mention.