IIRC, when Apple introduced the new Network Extension and Endpoint Security system extension architectures, apps with Network Extensions in their bundle had to be distributed through the Mac App Store, whereas apps with Endpoint Security extensions could not be distributed through the Mac App Store (or vice versa).
I can no longer find language on such restrictions.
Can I distribute an app with both a Network Extension and an Endpoint Security extension in the same app bundle via the Mac App Store?