I'm sure his MDM-enforced gatekeeper setting is on "Apps downloaded from the App Store" and not in the default position that includes "and identified developers".

https://support.apple.com/guide/mdm/security-privacy-payload...