The app is signed and notarized and the dmg is not.
Code Block codesign -vvd /Applications/Pluto.app
Executable=/Applications/Pluto.app/Contents/MacOS/Pluto
Identifier=com.pluto.office
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20500 size=1756 flags=0x10000(runtime) hashes=46+5 location=embedded
Signature size=9059
Authority=Developer ID Application: Sambhav Sharma (MCS363NKV7)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=21 Mar 2021 at 21:00:18
Info.plist entries=30
TeamIdentifier=MCS363NKV7
Runtime Version=11.0.0
Sealed Resources version=2 rules=13 files=34
Internal requirements count=1 size=176
Code Block spctl -vvv -a -t open --context context:primary-signature /Applications/Pluto.app
/Applications/Pluto.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Sambhav Sharma (MCS363NKV7)