The app did bypass Gatekeeper, so there was a legitimately serious vulnerability here. I have Gatekeeper turned off on my own machines, but if it's turned on it should be expected to work.