VPN System Extension blocked even though it's notarized, requires user open macOS System Preferences. Is it b/c the app is not on the mac AppStore?

Question

I have an application that we're developing that provides VPN System Extension for macOS. I have successfully built, signed and notarized the app.

When we install the package the user sees this popup:

The program tried to load new system extension(s). If you want to enable these extensions, open Security & Privacy System Preferences.

However when I download an existing VPN app from the macOS AppStore I see this popup when the extension is being installed:

Why am I getting the blocked popup when my app has been notarized? Is it because it's not coming from the AppStore?

Answer 1

As far as I'm aware, VPNs implemented via the NetworkExtension Framework don't necessarily need to be installed as System Extensions. This is probably the distinction you're running into. You can check the list of all system extensions in the system using the following Terminal command:

systemextensionsctl list
0 extension(s)

If the "Turbo VPN" extension is not listed there, it was not installed using the OSSystemExtensionManager API.

Only system extensions need to go through the System Preferences user approval process.