The way to think of notarization is that it's basically the same thing as Windows Defender's Automatic Sample Submission, which sends unknown executables to Mic

The way to think of notarization is that it's basically the same thing as Windows Defender's Automatic Sample Submission, which sends unknown executables to Microsoft for analysis. Only instead of having the end-user's machine upload the executable the first time it's run, the developer has to upload it to Apple. (This is better from a privacy/marketing standpoint.) In this case, the user application also had to explicitly request permission to run unsigned just-in-time-compiled code. This makes sense because macOS apps are typically written in compiled languages like Objective-C or Swift, so executing unsigned code usually means someone's doing something bad like a buffer overflow attack. Also, Apple probably wants to collect metrics on how many apps use JIT (and how) so they can restrict it more in future OS releases. I agree that a well-implemented sandbox seems like a much better solution here.