TFA says the default security setting DOES run any signed app. The two non-default settings are tighter (App Store only) and looser (any app).