> Recent versions of macOS default to only allowing apps from the App Store.

That's incorrect, with the introduction of Gatekeeper the default setting for it was to allow only signed apps — all app store apps are signed, but developer can sign apps outside of app store. The default setting didn't change since then.