I suggested the approach, but I don't really support us facilitating the circumvention of a system security feature (or annoyance, based on your perspective). At the least, it shouldn't be considered Pd's "standard practice" for macOS, in my opinion.
Hypothetically, what if someone uploads a malicious external to deken, knowing that someone will blindly download, install, remove quarantine, and urn it? Is the onus partially on whoever wrote the plugin as well as the original actor?
I suppose another approach is to have an upload server that automatically signs the library contents of a zip file and creates a notarized dmg for deken using a "shared" Apple developer account. I feel this leads us to the same potential problem if it is truly open to whoever.