This is correct. I added it to the Pd app bundle entitlements to get rid of the error dialog for (older) externals on macOS 10.15, I believe:

https://github.com/pure-data/pure-data/blob/master/mac/stuff/pd.entitlements

https://eclecticlight.co/2021/01/07/notarization-the-hardened-runtime/

If you start signing dynamic libs, I think you also need to set the min deployment target to 10.9 or above, at least for apps with a "hardened run-time" but I'm not sure if Pd does since we are (re)using the Wish app from the Tk build process. (I *think* it is as it is enabled during the code sign steps which apply the entitlements?.) The security settings like these are much more obvious when making a more "native app" via Xcode but less so when building on the command line. In any case, I did a quick search and found the following:

https://developer.apple.com/forums/thread/130065

https://developer.apple.com/documentation/security/hardened_runtime

etc...

(Sorry for not being the authority on this. I honestly try to write scripts for this so I can flush my memory every time I deal with code signing.)

On May 4, 2022, at 8:32 AM, pd-dev-request@lists.iem.at wrote:

i guess that while Pd has the permission to load *unsigned* externals, 
macOS still refuses to load *signed* externals with an invalid signature.

--------
Dan Wilcox
@danomatika
danomatika.com
robotcowboy.com