Looks like Apple does enforce signing and sandboxing for app store apps and should be able to do the same for side loaded apps: https://developer.apple.com/documentation/security/app-sa…