You can run what ever you want, it doesn’t stop you outright, it just asks you a bunch of times and makes you jump through some hoops if the program isn’t from a verified source. It’s annoying for someone who knows what they’re doing, but arguably a good backstop to keep someone clueless from running something hostile. It’s a complicated enough process that someone who doesn’t know what they’re doing won’t be able to run it.

Arguably it’s overkill and them trying to force users to stay in their closed “verified” garden, but it’s not totally unjustified.