Hmm, I wonder about a flag instead for .dmg files that would extract the contents on open, similar to .zip files.

I think there is a difference between a flag in the Info.plist file (intention) and a signed disk image. The first means that any app with the flag is still vulnerable to being repackaged with malicious external resources. The second means that the contents can't be modified without resigning, reducing the attack surface to having a valid developer certificate. (Unless a signed disk image requires the same certificate as the app inside.)

So some sort of flag (or hidden file in the image, to avoid changing the disk image format) in order for the open action to be changed to automatically extract the contents would give the same user experience as a .zip file currently does but still enforces the security policy on the app contained within.

I don't develop apps, so I don't have any experience here. But it seems to address the core problem, wouldn't it? Or is it more, where even apps dragged out from a signed disk image still get GPR enforcement as long as they're executed outside of "/Applications"?