" Out of the box, apps from unidentified developers are not allowed to run. The user has to explicitly allow them. "

I understand this, but this is an extremely low barrier - especially if the user actually wants to run the dam software they just installed, they have to 'allow it to run'.

Who's going to install software and then 'not allow it to run'?

I don't think this security feature has much effect at all.