Why am I able to run my own app without code signing?

Solution 1:

com.apple.quarantine

The locally built application does not have the quarantine attribute set. Without this extended file attribute, the application bypasses macOS's Gatekeeper and verification steps.

The quarantine attribute is set when the application is downloaded or copied onto the computer.

Try uploading a compressed copy of your application onto a web server, then downloading the file. After downloading and expanding the application, macOS will now apply Gatekeeper and verify the contents.

See How to set (restore) the com.apple.quarantine attribute?